CVE-2026-49299: CWE-863 Incorrect Authorization in OpenStack Neutron
CVE-2026-49299 is an authorization vulnerability in OpenStack Neutron before version 28.0.1. The issue arises because the tagging controller uses plural policy action names for single-tag write operations, while the policy rules use singular names. This mismatch causes the default policy to allow project readers to create and update tags on resources within the same project. Versions 26.0.0, 27.0.0, and 28.0.0 of Neutron are affected.
AI Analysis
Technical Summary
OpenStack Neutron versions 26.0.0 through 28.0.0 have an incorrect authorization issue (CWE-863) due to a mismatch between plural action names enforced by the tagging controller and singular names defined in policy rules. This mismatch causes the default policy to evaluate these operations as allowed, enabling users with project reader privileges to create and update tags on resources within their project. This vulnerability affects deployments running Neutron 26.0.0 or later but before 28.0.1.
Potential Impact
An attacker with project reader privileges can create and update tags on resources within the same project, actions that should be restricted. This could lead to unauthorized modification of resource metadata, potentially impacting resource management and policy enforcement within the project scope. There is no indication of privilege escalation beyond project reader or impact on resources outside the project.
Mitigation Recommendations
No official fix or patch is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the OpenStack vendor advisory for current remediation guidance. Until a fix is available, review and adjust policy configurations to ensure that tagging operations are properly restricted. Consider limiting project reader permissions or monitoring tag changes as a temporary mitigation.
CVE-2026-49299: CWE-863 Incorrect Authorization in OpenStack Neutron
Description
CVE-2026-49299 is an authorization vulnerability in OpenStack Neutron before version 28.0.1. The issue arises because the tagging controller uses plural policy action names for single-tag write operations, while the policy rules use singular names. This mismatch causes the default policy to allow project readers to create and update tags on resources within the same project. Versions 26.0.0, 27.0.0, and 28.0.0 of Neutron are affected.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/openstack/neutronRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenStack Neutron versions 26.0.0 through 28.0.0 have an incorrect authorization issue (CWE-863) due to a mismatch between plural action names enforced by the tagging controller and singular names defined in policy rules. This mismatch causes the default policy to evaluate these operations as allowed, enabling users with project reader privileges to create and update tags on resources within their project. This vulnerability affects deployments running Neutron 26.0.0 or later but before 28.0.1.
Potential Impact
An attacker with project reader privileges can create and update tags on resources within the same project, actions that should be restricted. This could lead to unauthorized modification of resource metadata, potentially impacting resource management and policy enforcement within the project scope. There is no indication of privilege escalation beyond project reader or impact on resources outside the project.
Mitigation Recommendations
No official fix or patch is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the OpenStack vendor advisory for current remediation guidance. Until a fix is available, review and adjust policy configurations to ensure that tagging operations are properly restricted. Consider limiting project reader permissions or monitoring tag changes as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-05-28T21:53:02.642Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a18bf3ae29bf47b50390f2c
Added to database: 05/28/2026, 22:18:34 UTC
Last enriched: 07/02/2026, 23:15:10 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.