01 Record

CVE-2026-74248

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of

MediumPUBLISHEDCNA: mitre

Base score4.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

View raw JSON CVE Program record

02 Description

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of

03 Metadata

Published: 2026-08-14 20:20Z1 HR AGO
Last updated: 2026-08-14 20:20Z1 HR AGO
Reserved: 2026-08-14
Assigning CNA: mitre
Record state: PUBLISHED
Severity: Medium (CVSS 4.3)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses: CWE-863
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: 800388a581708cd1111d9ed0b74faf673031d27a4e59932ce91aa4b60d539340

04 Affected products

VendorProductVersionsPlatforms

OpenStackOctavia0 to < 16.0.2, 17.0.0, 18.0.0—

05 References

bugs.launchpad.nethttps://bugs.launchpad.net/octavia/+bug/2161500
www.openwall.comhttps://www.openwall.com/lists/oss-security/2026/08/13/12

01 Record