Neutron Tagging Policy Bypass via Policy Name Mismatch

Executive Summary

This vulnerability exists in OpenStack Neutron versions before 28.0.1. The issue is that the tagging controller enforces plural policy action names for single-tag write operations, while the defined policy rules use singular names. Because of this mismatch, the policy evaluation defaults to allowing the action. As a result, a project reader, who normally should have limited permissions, can create and update tags on resources within the same project.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a user with project reader permissions to create and update tags on resources within the same project. This means that users with limited access can modify metadata tags, potentially leading to unauthorized changes in resource classification or management, which could affect resource tracking, billing, or access control policies.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how CVE-2026-49299 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-49299, you should apply the patches that have been proposed and merged to fix the policy enforcement mismatch in OpenStack Neutron's tagging controller.

Ensure your Neutron deployment is updated to version 28.0.1 or later, as versions before 28.0.1 are affected.

Review and update your policy files to ensure consistency between policy rule names and the actions enforced by the tagging controller.

Useful 0 Not Useful 0