Policy Mismatch Vulnerability in OpenStack Neutron by OpenStack

CVE-2026-49299

What is CVE-2026-49299?

In OpenStack Neutron versions prior to 28.0.1, a vulnerability exists where the tagging controller's enforcement of plural policy action names during single-tag write operations contradicts the defined policy rules that use singular names. This misalignment results in inadequate access controls, allowing a project reader to create and update tags on resources within the same project. Environments utilizing Neutron versions 26.0.0 or later are susceptible to this issue, underscoring the need for immediate remediation through available patches.

References