CVE-2026-74248

Published: Aug 14, 2026Modified: Aug 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://bugs.launchpad.net/octavia/+bug/2161500

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2026/08/13/12

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2026/08/17/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.launchpad.net/octavia/+bug/2161500

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.