CVE-2026-49299: OpenStack Neutron incorrect authorization in tagging controller

CVE-2026-49299 · Severity: medium · CVSS 4 · Published 2026-05-28

OpenStack Neutron, the networking service for OpenStack cloud environments, contains a flaw in how it handles resource tagging. This vulnerability allows users with 'reader' privileges to bypass security policies and modify or create tags on resources within their project. While this does not grant access to sensitive data, it allows unauthorized modification of resource metadata, which could disrupt organizational workflows or automated systems that rely on accurate tagging.

Technologies: OpenStack Neutron, neutron (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-49299 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49299 being exploited in the wild.
How severe is CVE-2026-49299?
Medium severity, with a CVSS score of 4, published 28 May 2026.
Which products and versions are affected?
OpenStack Neutron >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.3; >= 28.0.0, < 28.0.1, >=26.0.0, <28.0.1; neutron (PyPI) ECOSYSTEM:introduced=26.0.0,fixed=26.0.4,introduced=27.0.0,fixed=27.0.3,introduced=28.0.0,fixed=28.0.1, ECOSYSTEM:introduced=28.0.0,fixed=28.0.1.
Is there a fix for CVE-2026-49299?
Yes. neutron (PyPI): upgrade to 28.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49299 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-49299?
Check whether you run OpenStack Neutron or neutron (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • neutron (PyPI): upgrade to 28.0.1 or later
    pip install "neutron>=28.0.1"

Technical details

An incorrect authorization vulnerability exists in OpenStack Neutron's tagging controller. The root cause is a naming mismatch where the controller enforces plural policy action names for single-tag write operations, while the actual defined policy rules utilize singular names. Under default configurations, these mismatched names fail to trigger the intended restrictions, evaluating as 'allowed'. A remote attacker with low-privileged 'project reader' credentials can exploit this over the network to perform unauthorized create and update operations on tags for resources within the same project. The issue is resolved in versions 26.0.4, 27.0.3, and 28.0.1.

Affected products

  • OpenStack Neutron >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.3; >= 28.0.0, < 28.0.1

Identifiers

  • CVE-2026-49299
  • GHSA-xv24-hxh9-2hh9
  • PYSEC-2026-2678

Timeline

  • 2026-05-28: disclosed: Original OSSA-2026-016 advisory published
  • 2026-05-28: advisory: CVE-2026-49299 assigned
  • 2026-05-29: advisory: GitHub Advisory published
  • 2026-07-02: patched: Advisory updated with reviewed status and patched versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.