Red Hat OpenStack Updates Fix botocore Header Injection
Tech GuruQuick Answer
Red Hat issued four Important OpenStack errata for CVE-2026-114406 in botocore. Inventory exact product streams and python-botocore builds, install the signed package for each entitlement, validate API and automation workflows, monitor exceptions, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory OpenStack 13 ELS, 16.2, 17.1, and RHOSO 18 environments, exact botocore packages, repositories, API consumers, automation, owners, and maintenance windows. Match each system to its exact RHSA and entitlement; do not install a package for another OpenStack stream or infer exploitation from an affected package. Install the signed python-botocore build listed by the applicable Red Hat erratum through the supported repository and follow the product update procedure. Confirm installed NEVRA values, exercise representative OpenStack APIs and automation, monitor service health and logs, document exceptions, and retain package evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenStack Platform 13 ELS, 16.2, 17.1, and Red Hat OpenStack Services on OpenShift 18.0 |
|---|---|
| Advisory | RHSA-2026:93043 / RHSA-2026:93046 / RHSA-2026:93044 / RHSA-2026:93045 |
| CVE | CVE-2026-114406 |
| Authoritative release date | 2026-10-30 12:13:02 UTC |
| Authority revision date | 2026-10-30 12:16:26 UTC |
| Affected versions | The advisory-listed python-botocore packages before the exact signed builds in RHSA-2026:93043, RHSA-2026:93044, RHSA-2026:93045, and RHSA-2026:93046. |
| Fixed version | python-botocore-0:1.12.119-4.el8ost.src; python-botocore-0:1.20.68-2.el9ost.src; python-botocore-0:1.27.89-3.el9ost.src; python-botocore-0:1.8.33-2.el7ost.src |
| CVSS base score | 6.8 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Red Hat does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Red Hat issued four Important errata for CVE-2026-114406 in botocore across supported OpenStack streams.
What To Validate Now
- Inventory. Inventory OpenStack 13 ELS, 16.2, 17.1, and RHOSO 18 environments, exact botocore packages, repositories, API consumers, automation, owners, and maintenance windows.
- Establish applicability. Match each system to its exact RHSA and entitlement; do not install a package for another OpenStack stream or infer exploitation from an affected package.
- Remediate. Install the signed python-botocore build listed by the applicable Red Hat erratum through the supported repository and follow the product update procedure.
- Validate. Confirm installed NEVRA values, exercise representative OpenStack APIs and automation, monitor service health and logs, document exceptions, and retain package evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
OpenStack streams and ELS entitlements use different builds. Stage changes around control-plane dependencies and preserve rollback and repository evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
