---
id: CVE-2026-49299
aliases:
  - GHSA-xv24-hxh9-2hh9
title: OpenStack Neutron has an Incorrect Authorization issue
summary: OpenStack Neutron has an Incorrect Authorization issue
severity: medium
vendor: neutron
product: neutron
ecosystem: pip
affected:
  - 'neutron >= 28.0.0, < 28.0.1'
  - 'neutron >= 27.0.0, < 27.0.3'
  - 'neutron >= 26.0.0, < 26.0.4'
patched:
  - neutron 28.0.1
  - neutron 27.0.3
  - neutron 26.0.4
published: '2026-05-29'
updated: '2026-07-02'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-xv24-hxh9-2hh9'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49299'
  - url: 'https://bugs.launchpad.net/bugs/2150132'
  - url: 'https://github.com/openstack/neutron'
  - url: 'https://review.opendev.org/c/openstack/neutron/+/989099'
  - url: 'https://www.openwall.com/lists/oss-security/2026/05/28/8'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/02/7'
tags:
  - osv
  - pip
epss: 0.00295
epssPercentile: 0.22356
ingestedAt: '2026-07-08T18:25:54.679Z'
---

## Overview

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

## Affected packages

- `neutron >= 28.0.0, < 28.0.1`
- `neutron >= 27.0.0, < 27.0.3`
- `neutron >= 26.0.0, < 26.0.4`

## Remediation

Upgrade to a patched release:

- `neutron 28.0.1`
- `neutron 27.0.3`
- `neutron 26.0.4`