CVE-2026-49299

State: Published
Severity: 5.3 Medium
Published: May 28, 2026
Updated: Jun 2, 2026
Reserved: May 28, 2026

Description

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	mitre

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
NeutronOpenStack	26.0.0 to before 26.0.4Affected 27.0.0 to before 27.0.3Affected 28.0.0 to before 28.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.