PT-2026-53515 · Pypi · Octavia

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert reqs option is True but is supposed to be ssl.CERT REQUIRED.

Fix

Related Identifiers

PYSEC-2026-433

Affected Products

Octavia

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2019-17134 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-433 · Vendor Advisory
• https://github.com/openstack/octavia · Note
• https://github.com/openstack/octavia/commit/b0c2cd7b4c835c391cfedf12cf9f9ff8a0aabd17 · Note
• https://github.com/openstack/octavia/commit/c2fdffc3b748f8007c72e52df257e38756923b40 · Note
• https://github.com/openstack/octavia/commit/89a2f6e0136ad49d928eb65b4cf555af2a2b8ab1 · Note
• https://github.com/openstack/octavia/commit/624ff08f27bcb73788663cbe6d35cbe29c537844 · Note
• https://github.com/openstack/octavia/commit/1725517d1d209f26b2275306d83e49c099dcbe1a · Note
• https://github.com/openstack/octavia/commit/2976a7f0f109e17930db8a61136526ead44ea7e5 · Note
• https://storyboard.openstack.org/#!/story/2006660 · Note
• https://security.openstack.org/ossa/OSSA-2019-005.html · Note
• https://review.opendev.org/686546 · Note
• https://review.opendev.org/686547 · Note
• https://review.opendev.org/686543 · Note
• https://review.opendev.org/686545 · Note