# CVE-2026-49299: OpenStack Neutron incorrect authorization in tagging controller

Source: https://junglewise.ai/threats/cve-2026-49299-openstack-neutron-incorrect-authorization-in-tagging-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-49299 · Severity: medium · CVSS 4 · Published 2026-05-28

OpenStack Neutron, the networking service for OpenStack cloud environments, contains a flaw in how it handles resource tagging. This vulnerability allows users with 'reader' privileges to bypass security policies and modify or create tags on resources within their project. While this does not grant access to sensitive data, it allows unauthorized modification of resource metadata, which could disrupt organizational workflows or automated systems that rely on accurate tagging.

Technologies: [OpenStack Neutron](https://junglewise.ai/threats/technologies/neutron), [neutron (PyPI)](https://junglewise.ai/threats/technologies/pypi-neutron). Vendors: [OpenStack](https://junglewise.ai/threats/vendors/openstack), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-49299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49299 being exploited in the wild.

**How severe is CVE-2026-49299?** Medium severity, with a CVSS score of 4, published 28 May 2026.

**Which products and versions are affected?** OpenStack Neutron >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.3; >= 28.0.0, < 28.0.1, >=26.0.0, <28.0.1; neutron (PyPI) ECOSYSTEM:introduced=26.0.0,fixed=26.0.4,introduced=27.0.0,fixed=27.0.3,introduced=28.0.0,fixed=28.0.1, ECOSYSTEM:introduced=28.0.0,fixed=28.0.1.

**Is there a fix for CVE-2026-49299?** Yes. neutron (PyPI): upgrade to 28.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49299 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-49299?** Check whether you run OpenStack Neutron or neutron (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- neutron (PyPI): upgrade to 28.0.1 or later

  ```sh
  pip install "neutron>=28.0.1"
  ```


## Technical details

An incorrect authorization vulnerability exists in OpenStack Neutron's tagging controller. The root cause is a naming mismatch where the controller enforces plural policy action names for single-tag write operations, while the actual defined policy rules utilize singular names. Under default configurations, these mismatched names fail to trigger the intended restrictions, evaluating as 'allowed'. A remote attacker with low-privileged 'project reader' credentials can exploit this over the network to perform unauthorized create and update operations on tags for resources within the same project. The issue is resolved in versions 26.0.4, 27.0.3, and 28.0.1.

## Affected products

- OpenStack Neutron >= 26.0.0, < 26.0.4; >= 27.0.0, < 27.0.3; >= 28.0.0, < 28.0.1

## Identifiers

- CVE-2026-49299
- GHSA-xv24-hxh9-2hh9
- PYSEC-2026-2678

## Timeline

- 2026-05-28: disclosed: Original OSSA-2026-016 advisory published
- 2026-05-28: advisory: CVE-2026-49299 assigned
- 2026-05-29: advisory: GitHub Advisory published
- 2026-07-02: patched: Advisory updated with reviewed status and patched versions

## References

- [https://bugs.launchpad.net/bugs/2150132](https://bugs.launchpad.net/bugs/2150132)
- [https://review.opendev.org/c/openstack/neutron/+/989099](https://review.opendev.org/c/openstack/neutron/+/989099)
- [https://www.openwall.com/lists/oss-security/2026/05/28/8](https://www.openwall.com/lists/oss-security/2026/05/28/8)
- [http://www.openwall.com/lists/oss-security/2026/06/02/7](http://www.openwall.com/lists/oss-security/2026/06/02/7)

## Related threats

- [OpenStack Neutron subnetpool onboarding authorization bypass](https://junglewise.ai/threats/cve-2026-55707-openstack-neutron-subnetpool-onboarding-authorization-bypass)
- [PYSEC-2026-1693 - OpenStack Neutron can use an incorrect ID during policy enforcement](https://junglewise.ai/threats/cve-2024-53916-openstack-neutron-can-use-an-incorrect-id-during-policy)
- [PYSEC-2026-1694 - Denial of service in neutron](https://junglewise.ai/threats/cve-2023-3637-denial-of-service-in-neutron)
- [PYSEC-2026-855 - openstack-neutron uncontrolled resource consumption flaw](https://junglewise.ai/threats/cve-2022-3277-openstack-neutron-uncontrolled-resource-consumption-flaw)
- [PYSEC-2026-858 - OpenStack Nova Router metadata queries are not restricted by tenant](https://junglewise.ai/threats/cve-2013-6419-openstack-nova-metadata-queries-tenant-isolation-bypass)