CVE-2026-49299: OpenStack Neutron Incorrect Authorization Vulnerability
Summary
CVE-2026-49299: OpenStack Neutron has an Incorrect Authorization issue. Affects neutron across 3 version ranges.
>= 26.0.0, < 26.0.4
>= 27.0.0, < 27.0.3
>= 28.0.0, < 28.0.1
Fixed in 26.0.4, 27.0.3 or 28.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Neutron is a core component of the OpenStack cloud computing platform, responsible for providing networking as a service between interface devices managed by other OpenStack services. It allows users to create and manage networks, subnets, and routers, enabling flexible and scalable network configurations. However, certain versions of Neutron are vulnerable to an incorrect authorization issue that can lead to unauthorized access to tagging operations.
Vulnerability Detail
In OpenStack Neutron versions prior to 28.0.1, there exists an incorrect authorization issue within the tagging controller. The controller enforces plural policy action names for single-tag write operations, while the defined policy rules utilize singular names. This mismatch results in the default policy evaluating as allowed, which permits project readers to create and update tags on resources within the same project. This vulnerability can lead to unauthorized modifications of resource tags, potentially impacting the integrity and security of the project’s resources.
How To Fix
Latest published version: 29.0.0 as of 22 Oct 2026
pip install --upgrade "neutron==29.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 26.0.0, < 26.0.426.0.4pip install --upgrade "neutron==26.0.4" -
>= 27.0.0, < 27.0.327.0.3pip install --upgrade "neutron==27.0.3" -
>= 28.0.0, < 28.0.128.0.1pip install --upgrade "neutron==28.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can review and adjust the policy rules to ensure that they align with the plural naming convention enforced by the tagging controller. However, this is not a permanent fix and should be followed by an upgrade to the patched versions as soon as possible.
Conclusion
The incorrect authorization vulnerability in OpenStack Neutron poses a significant risk by allowing unauthorized users to manipulate resource tags. It is crucial for users to upgrade to the latest patched versions to mitigate this risk and ensure the security of their OpenStack deployments.
See every vulnerability recorded for neutron →
FAQ
CVE-2026-49299 is a vulnerability in OpenStack Neutron that allows unauthorized users to create and update tags on resources due to incorrect authorization handling.
OpenStack Neutron versions 26.0.0 to 28.0.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
If an immediate upgrade is not possible, review and adjust your policy rules as a temporary workaround, but prioritize upgrading to a patched version as soon as feasible.
Related vulnerabilities
Recent vulnerabilities recorded for neutron.
