GitHub Advisoryadvisory · PyPI

GHSA-xv24-hxh9-2hh9 OpenStack Neutron has an Incorrect Authorization issue

MEDIUM Published 2026-05-29 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-49299
Ecosystem
PyPI
Packages
neutron
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-863
Reviewed
2026-07-02

Affected packages

• PyPI neutron: >= 28.0.0, < 28.0.1 → fixed in 28.0.1 • PyPI neutron: >= 27.0.0, < 27.0.3 → fixed in 27.0.3 • PyPI neutron: >= 26.0.0, < 26.0.4 → fixed in 26.0.4

Description

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

Related

Alias · CVE (1)

  • CVE-2026-49299 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References