{"id":"CVE-2026-49299","aliases":["GHSA-xv24-hxh9-2hh9","PYSEC-2026-2678"],"url":"https://o3.security/vulnerability/CVE-2026-49299","summary":"OpenStack Neutron has an Incorrect Authorization issue","details":"In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.","published":"2026-05-28T21:53:03.408Z","modified":"2026-08-12T03:51:14.083704656Z","cvss":null,"epss":{"score":0.00295,"percentile":0.21451,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"neutron","fixedVersion":"28.0.1"},{"ecosystem":"PyPI","name":"neutron","fixedVersion":"27.0.3"},{"ecosystem":"PyPI","name":"neutron","fixedVersion":"26.0.4"}],"fix":null,"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/06/02/7"},{"type":"WEB","url":"https://opendev.org/openstack/neutron"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/05/28/8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49299.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49299"},{"type":"REPORT","url":"https://bugs.launchpad.net/bugs/2150132"},{"type":"FIX","url":"https://review.opendev.org/c/openstack/neutron/+/989099"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:14.083704656Z"}}