CVE-2026-49299 OpenStack Neutron has an Incorrect Authorization issue
A policy mismatch in OpenStack Neutron allows project readers to modify tags on resources, bypassing intended authorization restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49299?
CVE-2026-49299 is a medium-severity missing authorization vulnerability in OpenStack Neutron, published on 28 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.
Weakness: CWE-863
Which versions are affected by CVE-2026-49299?
7 open source packages ship an affected version, including neutron.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | From 26.0.0 | 26.0.4, 27.0.3, 28.0.1 |
neutron PyPI | From 26.0.0 | 26.0.4 |
neutron PyPI | From 26.0.0 | 26.0.4 |
neutron PyPI | From 27.0.0 | 27.0.3 |
neutron PyPI | From 27.0.0 | 27.0.3 |
neutron PyPI | From 28.0.0 | 28.0.1 |
1 more packages
neutron PyPI | From 28.0.0 | 28.0.1 |
How do I fix CVE-2026-49299?
Upgrade neutron to a fixed version for your release line: 26.0.4, 27.0.3 or 28.0.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-49299 being exploited?
There is no known exploitation of CVE-2026-49299 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-49299, GHSA-xv24-hxh9-2hh9, PYSEC-2026-2678, UBUNTU-CVE-2026-49299.