Is CVE-2026-74248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74248 being exploited in the wild.

How severe is CVE-2026-74248?

Medium severity, with a CVSS score of 4.3, published 14 August 2026.

Which products and versions are affected?

OpenStack Octavia through 18.0.0.

Is there a fix for CVE-2026-74248?

A patch was published on 2026-08-13: Patches available for 2025.1, 2025.2, 2026.1, and 2026.2 releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74248 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74248?

Check whether you run OpenStack Octavia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74248: OpenStack Octavia QoS policy authorization bypass

CVE-2026-74248 · Severity: medium · CVSS 4.3 · Published 2026-08-14

OpenStack Octavia is a load-balancing service that manages virtual load balancers in cloud environments. An authenticated user can associate another project's private quality-of-service (QoS) policy with their own load balancer without proper authorization, which prevents the policy owner from deleting that policy. This creates a denial-of-service scenario where legitimate administrators cannot manage their QoS policies, potentially disrupting network traffic management across the infrastructure.

Technologies: OpenStack Octavia. Vendors: OpenStack.

Quick answers

Is CVE-2026-74248 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74248 being exploited in the wild.
How severe is CVE-2026-74248?: Medium severity, with a CVSS score of 4.3, published 14 August 2026.
Which products and versions are affected?: OpenStack Octavia through 18.0.0.
Is there a fix for CVE-2026-74248?: A patch was published on 2026-08-13: Patches available for 2025.1, 2025.2, 2026.1, and 2026.2 releases Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74248 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74248?: Check whether you run OpenStack Octavia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in QoS policy validation caused by contextless Neutron API calls. When validating a QoS policy ID during load balancer creation or update, Octavia uses a service-level Neutron connection rather than the user's request context, allowing it to access private policies owned by other projects that the user cannot access directly. An authenticated attacker can update their load balancer to reference a foreign private QoS policy; Octavia applies this policy to the provider-managed VRRP port via the Amphora driver. The policy owner cannot delete the policy afterwards because Neutron enforces a dependency on the VRRP port. The vulnerability affects Octavia versions through 18.0.0 and requires only network access and valid project membership to exploit. Patches have been published for multiple OpenStack release branches.

Affected products

OpenStack Octavia through 18.0.0

Timeline

2026-08-13: disclosed
2026-08-13: advisory: OSSA-2026-035 published
2026-08-13: patched: Patches available for 2025.1, 2025.2, 2026.1, and 2026.2 releases

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.