CVE-2026-49299
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In OpenStack Neutron before version 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources.
Risk Assessment
The risk is that a user with the project reader role can unauthorizedly modify resource tags, potentially leading to data integrity and access policy violations in the OpenStack environment.
Recommendation
Immediately update OpenStack Neutron to version 28.0.1 or later, which includes a fix that resolves the mismatch in policy action names.
Other vulnerabilities in OpenStack Neutron
See all- CVE-2016-5363High
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic.
- CVE-2016-5362High
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic via a crafted DHCP discovery message.
- CVE-2014-0187High
The openvswitch-agent process in OpenStack Neutron versions 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
- CVE-2015-8914Critical
The IPTables firewall in OpenStack Neutron before 7.0.4 and from 8.0.0 to 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism, potentially leading to denial of service or interception of network traffic via a link-local source address.
- CVE-2026-55707High
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- CVE-2026-50266Low
In OpenStack Neutron before version 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value starting with "network:". Default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240.
- CVE-2023-3637Medium
An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project, leading to resources that are unconstrained by the user's quota.
Original NVD description (English source)
In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.