#1142113 OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning

Package:
src:nova
Source:
src:nova
Submitter:
Thomas Goirand
Date:
2026-07-15 17:35:04 UTC
Severity:
normal
Tags:
#1142113#5
Date:
2026-07-15 12:57:21 UTC
From:
To:
As per upstream announce at:
https://wiki.openstack.org/wiki/OSSN/OSSN-0101

Summary

The Nova console WebSocket proxy mutates a shared, process-global oslo.config
allowed_origins list on every incoming request by appending the
client-controlled Host header value. Because oslo.config returns a cached list
object, these appends persist for the lifetime of the proxy process. This
permanently weakens the cross-origin protection on the console proxy and
causes unbounded memory growth.

Affected Services / Software
    nova >=12.0.0 <31.3.2, >=32.0.0 <32.2.2, >=33.0.0 <33.0.3

Discussion
On each request, the proxy appends the Host header to
CONF.console.allowed_origins to allow the proxy's own hostname. This mutates
the shared oslo.config cached list rather than operating on a copy, so any
Host value ever seen is retained permanently for the life of the process.

An unauthenticated attacker can inject arbitrary hostnames into the allow-list
by sending requests with crafted Host headers, defeating the Origin check for
all subsequent requests. The unbounded list growth also enables a slow memory
exhaustion DoS.

Recommended Actions
Apply the provided Nova patches. The fix copies the config list before
appending, so mutations do not persist across requests.

Patches
The following reviews contain the fix for this issue:

    2026.2/hibiscus (development): https://review.opendev.org/c/openstack/nova/+/995870
    2026.1/gazpacho: https://review.opendev.org/c/openstack/nova/+/995956
    2025.2/flamingo: https://review.opendev.org/c/openstack/nova/+/995957
    2025.1/epoxy: https://review.opendev.org/c/openstack/nova/+/995958

Credits
Sergey r0binak Kanibor, Luntry
Contacts / References

    Authors: Goutham Pacha Ravi, Red Hat

    This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0101
    Original Launchpad bug: https://bugs.launchpad.net/nova/+bug/2158919
    Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org
    OpenStack Security : https://security.openstack.org/
    CVE: none

#1142113#8
Date:
2026-07-15 16:46:31 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/0b29e9c250f120c82a6a333f7547639c7579f875
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#13
Date:
2026-07-15 16:46:29 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/186e54903749ee898ae0296c4080afe76863d832
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#16
Date:
2026-07-15 16:46:30 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/0ccc94635fa6b70c3e4385b08f71c52ad061134e
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#19
Date:
2026-07-15 16:46:34 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/3eec94e10f086100c9e666a1469c637749d45f00
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#22
Date:
2026-07-15 16:46:37 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/d0fc5f002f83a11f1b49e1d38b5b8c8cfa08cf4f
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#25
Date:
2026-07-15 16:46:42 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/40d0c298569c24019c6e78e613ad99b116f44a5e
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#28
Date:
2026-07-15 16:46:43 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/37eaadd04c17bb44c0345ac517cc3f8c31485339
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#31
Date:
2026-07-15 16:46:40 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/f0ac05a40ec087dda89be44cae859c0faf4f4542
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#34
Date:
2026-07-15 16:46:45 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/629a9dcda462d433e25c9e97b448f499aca16242
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#39
Date:
2026-07-15 17:33:42 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
nova, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142113@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated nova package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 15 Jul 2026 14:38:22 +0200
Source: nova
Architecture: source
Version: 2:33.0.1-5
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1142113
Changes:
 nova (2:33.0.1-5) unstable; urgency=high
 .
   * OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
     Applied upstream patch: "Fix mutating global config in websocket proxy"
     (Closes: #1142113).
Checksums-Sha1:
 356230b61671fa5e2c2f4924c08ad5c9f28bf449 4706 nova_33.0.1-5.dsc
 24299cf3e9bb2dddba64bf7eae324ec188deacec 72672 nova_33.0.1-5.debian.tar.xz
 c8cdc35b669131c0e996b1a58c7a62536378bc29 25757 nova_33.0.1-5_amd64.buildinfo
Checksums-Sha256:
 5398cf7ece3524c75d1d4954759acd83898254ff773685e44385a158a2ecae76 4706 nova_33.0.1-5.dsc
 7e6722fc24d79cacb30a39fff8ead5b8e145cce05a4e3911790ef8e99f49a836 72672 nova_33.0.1-5.debian.tar.xz
 c0bbd339a60aec7f19b6321ec95665c5061171570dd10f0b3bfee11f61f7bf2b 25757 nova_33.0.1-5_amd64.buildinfo
Files:
 5e3cf9de8ed2a96ed032a07556bd415b 4706 net optional nova_33.0.1-5.dsc
 4e5ff29e97694d8f816be8bdcd09930d 72672 net optional nova_33.0.1-5.debian.tar.xz
 ef68e2f80d3bf4e1341b7c440abc5d4e 25757 net optional nova_33.0.1-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmpXv7cACgkQ1BatFaxr
Q/7axRAAgWY9NrYy1mJliVhF6mNlK0J5CDgz2w2UWdJF+KYotkGOiDrcvsWBVXWQ
Eb3SL5ORdZ7pypCXETjjVH7lee70S6upJRebx+5OVFxBLoO3YcjyQJmKI3s1UfmK
4LddGAa9iguoC0HSX3eU1rBT//XKVNL5sD3LEzDeplV1bC7Et2LtKvtJ8n2TL2Tk
2apuqF+9vKBzr8sCUsj6K88rLXvqjhq6nhDVCZT67Mx0ljJPEl7lnGABGVfKkyYX
YTsQv11lzpCmRgnmsbiwtRxj2jz8pEqAtZDmme3FumaJaQYTU2vqFZKI6oG3uAec
pucQXBCGb4POmi3xuit2UBVLDdnL55+fkB7d1Qngomlu/qKNl9wUu2Zpg6p6h8gg
sOntAcxMOjtDDiew6CD+gKCviFGKZXGnvjGHJcdwf7h4TI1FTCFkM+9jcanAMFwk
7EAZQvo9VRm0s/YNOcALA/nuvW/kAT/slPCJuECIn6KbcP7qMoy7UK2sGq5W8And
heiXYfcHpMi/VivjixVnrmDHiIMNJZnpBL3sLEol+qPaXjHK3InQbf2MOQXMP7Ic
zwF6TpG/cEHja3+DUoliGPfN5nP3Q404eQaOncAtOaO7CxqJBddiqJHiWt14PpTp
O487Y6I6vegtjgzgmO2nWJhmTReKRvIx7VoDJEzlnuKh+VQ400o=
=+ElW
-----END PGP SIGNATURE-----

#1142113#42
Date:
2026-07-15 17:32:49 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/e13c0919c578c94e1e52239e30262c36e4ff2923
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113

#1142113#47
Date:
2026-07-15 17:34:55 UTC
From:
To:
Hello,

Bug #1142113 in nova reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/openstack-team/services/nova/-/commit/c190dd3ea643f8ce4caf216b7433720b9d0d7a15
------------------------------------------------------------------------
* OSSN-0101: Nova console WebSocket proxy Origin allow-list poisoning.
    Applied upstream patch: "Fix mutating global config in websocket proxy"
    (Closes: #1142113).
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1142113