Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-49299 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write…

Description

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
Neutron 28.0 28.0.0 → < 28.0.1 28.0.1
Neutron 27.0 27.0.0 → < 27.0.3 27.0.3
Neutron 26.0 26.0.0 → < 26.0.4 26.0.4

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Neutron

Les 4 CVE de Neutron →
CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets 7.1 Élevée CVE-2026-50266 In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another… 2.2 Faible CVE-2024-53916 In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement 7.5 Élevée
Suivre cette CVE