{"id":"CVE-2026-74248","title":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization","summary":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments ar…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-863"],"published":"2026-08-14","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:03:22.897","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74248","references":[{"url":"https://bugs.launchpad.net/octavia/+bug/2161500","label":"cve@mitre.org"},{"url":"https://www.openwall.com/lists/oss-security/2026/08/13/12","label":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/08/17/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.launchpad.net/octavia/+bug/2161500","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00208,"epssPercentile":0.1126,"ingestedAt":"2026-09-09T16:14:05.513Z","slug":"CVE-2026-74248","body":"## Overview\n\nOpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}