OpenStack Octavia through versions 17.0.0 and 18.0.0 mishandles authorization checks related to QoS policies. Specifically, an authenticated user can associate a QoS policy belonging to a different project with an amphora, which prevents the deletion of that policy. This is classified under CWE-863 (Incorrect Authorization). The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no official remediation or patch information provided at this time.

An authenticated user can misuse authorization to associate another project's QoS policy with an amphora, preventing the deletion of that policy. This could lead to unintended persistence of QoS policies, potentially affecting resource management or policy lifecycle but does not impact confidentiality or availability directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published. Until a fix is available, review and monitor QoS policy associations carefully and restrict authenticated user permissions where possible to limit exposure.