CVE-2026-74248
published 2026-08-14CVE-2026-74248: OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.33%
25.3th percentile
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | octavia | < 16.0.2 | 16.0.2 |
| openstack | octavia | — | — |
| openstack | octavia | — | — |
| rhoso | openstack-octavia-api-rhel9 | — | — |
| rhoso | openstack-octavia-base-rhel9 | — | — |
| rhoso | openstack-octavia-health-manager-rhel9 | — | — |
| rhoso | openstack-octavia-housekeeping-rhel9 | — | — |
| rhoso | openstack-octavia-worker-rhel9 | — | — |
| rhosp-rhel8 | openstack-octavia-api | — | — |
| rhosp-rhel8 | openstack-octavia-base | — | — |
| rhosp-rhel8 | openstack-octavia-health-manager | — | — |
| rhosp-rhel8 | openstack-octavia-housekeeping | — | — |
| rhosp-rhel8 | openstack-octavia-worker | — | — |
| ubuntu | octavia | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_redhat4.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
OpenStack Octavia up to 16.0.1/17.0.0/18.0.0 improper authorization
vuldb·2026-08-14·CVSS 4.3
CVE-2026-74248 [MEDIUM] OpenStack Octavia up to 16.0.1/17.0.0/18.0.0 improper authorization
A vulnerability was found in OpenStack Octavia up to 16.0.1/17.0.0/18.0.0 and classified as problematic. This affects an unknown part. Such manipulation leads to improper authorization.
This vulnerability is listed as CVE-2026-74248. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization.
ghsa_unreviewed·2026-08-14
CVE-2026-74248 [MEDIUM] CWE-863 OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization.
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
Ubuntu
Octavia vulnerabilities
vendor_ubuntu·2026-09-24·CVSS 4.3
CVE-2026-94571 [MEDIUM] Octavia vulnerabilities
Title: Octavia vulnerabilities
Summary: Several security issues were fixed in Octavia.
It was discovered that Octavia did not properly validate TLS cipher
string fields in the Amphora provider driver. An authenticated
attacker who owns a TLS-enabled load balancer could possibly use
this issue to inject arbitrary HAProxy configuration directives.
(CVE-2026-94572)
It was discovered that Octavia did not properly validate L7 policy
redirect URL fields in the Amphora provider driver. An authenticated
attacker who owns a load balancer could possibly use this issue to
inject arbitrary HAProxy configuration directives. (CVE-2026-94571)
It was discovered that Octavia incorrectly handled quality of service
policy authorization. An authenticated attacker could possibly use
this issue to prevent d
Red Hat
octavia: OpenStack Octavia: Authenticated user can prevent QoS policy deletion
vendor_redhat·2026-08-14·CVSS 4.3
CVE-2026-74248 [MEDIUM] CWE-639 octavia: OpenStack Octavia: Authenticated user can prevent QoS policy deletion
octavia: OpenStack Octavia: Authenticated user can prevent QoS policy deletion
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
A flaw was found in OpenStack Octavia. An authenticated user can exploit this vulnerability by associating a Quality of Service (QoS) policy from another project with an amphora. This mishandling of QoS policy authorization may prevent the deletion of the policy, leading to a denial of service (DoS) condition for affected Octavia deployments.
Statement: A flaw was found in OpenStack Octavia's handling of Quality of Service (QoS) policy authorization. An authenticat
No detection rules found.
No public exploits indexed.
2026-08-14
Published