Executive brief
OpenStack Octavia is a load-balancing service that manages virtual load balancers in cloud environments. An authenticated user can associate another project's private quality-of-service (QoS) policy with their own load balancer without proper authorization, which prevents the policy owner from deleting that policy. This creates a denial-of-service scenario where legitimate administrators cannot manage their QoS policies, potentially disrupting network traffic management across the infrastructure.
Technical details
The vulnerability is an authorization bypass in QoS policy validation caused by contextless Neutron API calls. When validating a QoS policy ID during load balancer creation or update, Octavia uses a service-level Neutron connection rather than the user's request context, allowing it to access private policies owned by other projects that the user cannot access directly. An authenticated attacker can update their load balancer to reference a foreign private QoS policy; Octavia applies this policy to the provider-managed VRRP port via the Amphora driver. The policy owner cannot delete the policy afterwards because Neutron enforces a dependency on the VRRP port. The vulnerability affects Octavia versions through 18.0.0 and requires only network access and valid project membership to exploit. Patches have been published for multiple OpenStack release branches.
Affected products
- OpenStack Octavia through 18.0.0
Timeline
- 2026-08-13: disclosed
- 2026-08-13: advisory: OSSA-2026-035 published
- 2026-08-13: patched: Patches available for 2025.1, 2025.2, 2026.1, and 2026.2 releases