CVE-2026-74248

Received Received - Intake

OpenStack Octavia QoS Policy Authorization Bypass

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: MITRE

Description

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-14

Generated

2026-08-15

AI Q&A

2026-08-15

EPSS Evaluated

N/A

NVD

CVE-2026-74248

EUVD

EUVD-2026-58807

Affected Vendors & Products

Vendor	Product	Version / Range
openstack	octavia	to 18.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

OpenStack Octavia through version 18.0.0 has a vulnerability where authenticated users can associate another project's quality of service (QoS) policy with an amphora. This prevents the deletion of that policy, potentially causing unauthorized resource retention.

Impact Analysis

An attacker with access could prevent legitimate deletion of QoS policies, leading to resource exhaustion or unauthorized policy persistence. This may disrupt network performance or cause billing issues in cloud environments.

Mitigation Strategies

Review and restrict QoS policy associations in OpenStack Octavia to prevent unauthorized cross-project policy usage. Ensure only authorized projects can attach QoS policies to amphorae. Monitor logs for suspicious policy associations and unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-74248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70