CVE-2024-8007: Red Hat OpenStack Platform MITM Vulnerability

CVE-2024-8007 Overview

CVE-2024-8007 is an improper certificate validation flaw [CWE-295] in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. The vulnerability disables TLS certificate verification for container registry mirrors during deployment operations. An attacker positioned on the network can intercept registry traffic and serve compromised container images to the director without detection. Successful exploitation enables a man-in-the-middle (MITM) attack that delivers malicious workloads into the OpenStack control plane. Red Hat has issued advisories RHSA-2024:9990 and RHSA-2024:9991 to address the issue.

Critical Impact
Attackers performing network interception can deploy compromised container images to RHOSP director, leading to full compromise of confidentiality, integrity, and availability across the OpenStack environment.

Affected Products

Red Hat OpenStack Platform 16.1
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1

Discovery Timeline

2024-08-21 - CVE-2024-8007 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8007

Vulnerability Analysis

The flaw resides in openstack-tripleo-common, the shared library used by the RHOSP director (TripleO) to orchestrate overcloud deployment. During image preparation, the director pulls container images from upstream registries and configured mirror endpoints. The mirror handling logic disables TLS certificate verification, accepting any certificate presented by the mirror host. This breaks the trust chain that protects image authenticity in transit.

An attacker who can intercept traffic between the director and a registry mirror, through ARP spoofing, BGP hijacking, DNS poisoning, or a compromised network device, can present a self-signed certificate and serve substituted images. The director consumes those images as trusted artifacts and deploys them across overcloud nodes. The attack complexity is high because the adversary must hold a network position adjacent to registry traffic, but no privileges or user interaction are required.

Root Cause

The root cause is improper certificate validation [CWE-295]. The mirror retrieval logic in openstack-tripleo-common sets the TLS verification flag to false rather than validating the certificate chain against trusted certificate authorities. This design decision removes the only cryptographic control protecting image integrity over the wire.

Attack Vector

Exploitation requires network-adjacent positioning to registry mirror traffic. The attacker performs a MITM interception, terminates the TLS session with a forged or self-signed certificate, and serves crafted container images. When the director pulls and deploys those images, the attacker gains code execution inside containerized OpenStack services such as Nova, Neutron, or Keystone. From there, lateral movement across the control plane and tenant workloads is possible.

No verified public proof-of-concept exists, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-8007

Indicators of Compromise

Container images pulled from registry mirrors with certificate fingerprints that do not match the expected issuer chain.
Unexpected processes, listeners, or outbound connections originating from containerized OpenStack services after a director deployment or update.
TLS handshakes to registry mirror endpoints completing despite presenting self-signed or unknown certificates.
Modifications to tripleo container image manifests or digests outside of scheduled deployment windows.

Detection Strategies

Pin container image digests in director deployment templates and alert when running digests diverge from pinned values.
Inspect network flows from director hosts to registry mirrors and validate observed server certificates against a known-good allowlist.
Review tripleo-common deployment logs for entries showing TLS verification skipped or self-signed certificates accepted.

Monitoring Recommendations

Forward director, Podman, and container runtime logs to a centralized analytics platform for behavioral baselining of deployment operations.
Monitor egress from undercloud hosts and restrict registry traffic to known mirror IPs and ports.
Track process and file integrity on overcloud nodes following any image preparation run to surface tampered images quickly.

How to Mitigate CVE-2024-8007

Immediate Actions Required

Apply the Red Hat errata RHSA-2024:9990 and RHSA-2024:9991 to all RHOSP 16.1, 16.2, and 17.1 deployments.
Audit containers-prepare-parameter.yaml and related director configuration for mirror endpoints and replace untrusted mirrors with vendor-controlled registries.
Re-pull and verify checksums of container images deployed since the mirror configuration was introduced.

Patch Information

Red Hat addressed the flaw in updates to openstack-tripleo-common published in Red Hat Security Advisory RHSA-2024:9990 and Red Hat Security Advisory RHSA-2024:9991. Additional context is available in the Red Hat CVE Details CVE-2024-8007 advisory and Red Hat Bug Report #2305975.

Workarounds

Restrict registry mirror traffic to dedicated, segmented management networks not reachable by tenant or external networks.
Use only HTTPS registry mirrors hosted on infrastructure where certificate chains can be validated out-of-band.
Enforce IPsec or mutual TLS between the director and registry mirrors until patched packages are deployed.

bash

# Configuration example
# Apply patched openstack-tripleo-common packages on the undercloud
sudo dnf update openstack-tripleo-common

# Re-run image preparation against trusted registries only
openstack tripleo container image prepare \
  --output-env-file containers-prepare-parameter.yaml \
  --roles-file /usr/share/openstack-tripleo-heat-templates/roles_data.yaml