{"id":"CVE-2026-49299","aliases":["GHSA-xv24-hxh9-2hh9"],"title":"OpenStack Neutron has an Incorrect Authorization issue","summary":"OpenStack Neutron has an Incorrect Authorization issue","severity":"medium","vendor":"neutron","product":"neutron","ecosystem":"pip","affected":["neutron >= 28.0.0, < 28.0.1","neutron >= 27.0.0, < 27.0.3","neutron >= 26.0.0, < 26.0.4"],"patched":["neutron 28.0.1","neutron 27.0.3","neutron 26.0.4"],"published":"2026-05-29","updated":"2026-07-02","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xv24-hxh9-2hh9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49299"},{"url":"https://bugs.launchpad.net/bugs/2150132"},{"url":"https://github.com/openstack/neutron"},{"url":"https://review.opendev.org/c/openstack/neutron/+/989099"},{"url":"https://www.openwall.com/lists/oss-security/2026/05/28/8"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/02/7"}],"tags":["osv","pip"],"epss":0.00295,"epssPercentile":0.22303,"ingestedAt":"2026-07-08T18:25:54.679Z","slug":"CVE-2026-49299","body":"## Overview\n\nIn OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.\n\n## Affected packages\n\n- `neutron >= 28.0.0, < 28.0.1`\n- `neutron >= 27.0.0, < 27.0.3`\n- `neutron >= 26.0.0, < 26.0.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `neutron 28.0.1`\n- `neutron 27.0.3`\n- `neutron 26.0.4`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}