Executive brief
OpenStack Neutron, the networking service for OpenStack cloud environments, contains a flaw in how it handles resource tagging. This vulnerability allows users with 'reader' privileges to bypass security policies and modify or create tags on resources within their project. While this does not grant access to sensitive data, it allows unauthorized modification of resource metadata, which could disrupt organizational workflows or automated systems that rely on accurate tagging.
Technical details
An incorrect authorization vulnerability exists in OpenStack Neutron's tagging controller. The root cause is a naming mismatch where the controller enforces plural policy action names for single-tag write operations, while the actual defined policy rules utilize singular names. Under default configurations, these mismatched names fail to trigger the intended restrictions, evaluating as 'allowed'. A remote attacker with low-privileged 'project reader' credentials can exploit this over the network to perform unauthorized create and update operations on tags for resources within the same project. The issue is resolved in versions 26.0.4, 27.0.3, and 28.0.1.
Affected products
- OpenStack Neutron >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.3; >= 28.0.0, < 28.0.1
Timeline
- 2026-05-28: disclosed: Original OSSA-2026-016 advisory published
- 2026-05-28: advisory: CVE-2026-49299 assigned
- 2026-05-29: advisory: GitHub Advisory published
- 2026-07-02: patched: Advisory updated with reviewed status and patched versions