Skip to content
Sign in
4.3 Medium

CVE-2026-74248 OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization

Description

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

Affected products and versions

Product Affected versions Fixed in
Octavia 18.0.0 No fix stated
Octavia 17.0.0 No fix stated
Octavia 16.0 earliest → < 16.0.2 16.0.2

Other CVEs of Octavia

The 3 CVEs of Octavia →
CVE-2026-94572 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field… 9.4 Critical CVE-2026-94571 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy… 9.4 Critical
Track this CVE