CVE-2026-49299
Neutron Tagging Policy Bypass via Policy Name Mismatch
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openstack | neutron | From 26.0.0 (inc) to 28.0.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenStack Neutron versions before 28.0.1. The issue is that the tagging controller enforces plural policy action names for single-tag write operations, while the defined policy rules use singular names. Because of this mismatch, the policy evaluation defaults to allowing the action. As a result, a project reader, who normally should have limited permissions, can create and update tags on resources within the same project.
How can this vulnerability impact me? :
The vulnerability allows a user with project reader permissions to create and update tags on resources within the same project. This means that users with limited access can modify metadata tags, potentially leading to unauthorized changes in resource classification or management, which could affect resource tracking, billing, or access control policies.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-49299 affects compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-49299, you should apply the patches that have been proposed and merged to fix the policy enforcement mismatch in OpenStack Neutron's tagging controller.
Ensure your Neutron deployment is updated to version 28.0.1 or later, as versions before 28.0.1 are affected.
Review and update your policy files to ensure consistency between policy rule names and the actions enforced by the tagging controller.