{"id":"CVE-2026-74248","aliases":["DEBIAN-CVE-2026-74248","EUVD-2026-58807","GHSA-3gfv-q5hp-jpcf","UBUNTU-CVE-2026-74248","USN-8814-1"],"status":"published","title":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By...","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00325,"percentile":0.25895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-14T20:20:31Z","modified":"2026-11-12T03:00:07Z","fixes":[{"ecosystem":"Debian:12","package":"octavia","fixed_in":["11.0.0-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"octavia","fixed_in":["18.0.0-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"octavia","fixed_in":["1:10.1.1-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"octavia","fixed_in":["1:14.0.0-0ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"octavia","fixed_in":["1:18.0.0-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-2+deb12u1"}]}],"versions":["11.0.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.0.0-2","16.0.0-2+deb13u1","16.0.0-3","17.0.0-1","17.0.0-2","17.0.0-3","17.0.0-4","17.0.0-5","17.0.0~rc1-1","17.0.0~rc2-1","17.0.0~rc2-2","17.0.0~rc2-3","18.0.0-1","18.0.0-2","18.0.0-3","18.0.0-4","18.0.0~rc1-1","18.0.0~rc1-2","19.0.0-1","19.0.0-10","19.0.0-11","19.0.0-2","19.0.0-3","19.0.0-4","19.0.0-5","19.0.0-6","19.0.0-7","19.0.0-8","19.0.0-9","19.0.0~rc1-1","19.0.0~rc1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.0.0-3"}]}],"versions":["16.0.0-2","16.0.0-3","17.0.0-1","17.0.0-2","17.0.0-3","17.0.0-4","17.0.0-5","17.0.0~rc1-1","17.0.0~rc2-1","17.0.0~rc2-2","17.0.0~rc2-3","18.0.0-1","18.0.0-2","18.0.0~rc1-1","18.0.0~rc1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-0ubuntu1","6.0.0~b1~git2019121614.45cb1e4e-0ubuntu1","6.0.0~b2~git2020020614.005cd1e6-0ubuntu1","6.0.0~b2~git2020020614.005cd1e6-0ubuntu2","6.0.0~b3~git2020032609.73fca169-0ubuntu1","6.0.0~b3~git2020041014.771a5d87-0ubuntu1","6.0.0-0ubuntu0.20.04.1","6.0.0-0ubuntu0.20.04.2","6.1.0-0ubuntu1","6.2.0-0ubuntu1","6.2.1-0ubuntu1","6.2.1-0ubuntu2","6.2.2-0ubuntu1","6.2.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.1-0ubuntu1.5"}]}],"versions":["1:9.0.0-0ubuntu1","1:9.0.0+git2021120816.ab3c3ef7-0ubuntu1","1:9.0.1+git2022011217.27e5b27d-0ubuntu1","1:9.0.1+git2022030314.328ffbab-0ubuntu1","1:10.0.0-0ubuntu1","1:10.1.0-0ubuntu1","1:10.1.1-0ubuntu1","1:10.1.1-0ubuntu1.1","1:10.1.1-0ubuntu1.2","1:10.1.1-0ubuntu1.3","1:10.1.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0-0ubuntu1.6"}]}],"versions":["1:13.0.0-0ubuntu1","1:13.0.0+git2024011917.5750e451-0ubuntu1","1:14.0.0~rc1-0ubuntu1","1:14.0.0-0ubuntu1","1:14.0.0-0ubuntu1.1","1:14.0.0-0ubuntu1.2","1:14.0.0-0ubuntu1.3","1:14.0.0-0ubuntu1.4","1:14.0.0-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.0-0ubuntu2.1"}]}],"versions":["1:17.0.0-0ubuntu1","1:17.0.0+git20260116.e805a93-0ubuntu1","1:18.0.0~rc1-0ubuntu2","1:18.0.0-0ubuntu1","1:18.0.0-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.1-0ubuntu1.5"}]}],"versions":["1:9.0.0-0ubuntu1","1:9.0.0+git2021120816.ab3c3ef7-0ubuntu1","1:9.0.1+git2022011217.27e5b27d-0ubuntu1","1:9.0.1+git2022030314.328ffbab-0ubuntu1","1:10.0.0-0ubuntu1","1:10.1.0-0ubuntu1","1:10.1.1-0ubuntu1","1:10.1.1-0ubuntu1.1","1:10.1.1-0ubuntu1.2","1:10.1.1-0ubuntu1.3","1:10.1.1-0ubuntu1.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0-0ubuntu1.6"}]}],"versions":["1:13.0.0-0ubuntu1","1:13.0.0+git2024011917.5750e451-0ubuntu1","1:14.0.0~rc1-0ubuntu1","1:14.0.0-0ubuntu1","1:14.0.0-0ubuntu1.1","1:14.0.0-0ubuntu1.2","1:14.0.0-0ubuntu1.3","1:14.0.0-0ubuntu1.4","1:14.0.0-0ubuntu1.5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.0-0ubuntu2.1"}]}],"versions":["1:17.0.0-0ubuntu1","1:17.0.0+git20260116.e805a93-0ubuntu1","1:18.0.0~rc1-0ubuntu2","1:18.0.0-0ubuntu1","1:18.0.0-0ubuntu2"],"bundled":3}],"products":[{"vendor":"openstack","product":"octavia"}],"references":[{"url":"https://bugs.launchpad.net/octavia/+bug/2161500","tags":["exploit"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/13/12","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/17/2"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74248"},{"url":"https://github.com/advisories/GHSA-3gfv-q5hp-jpcf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-74248","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-74248","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74248","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8814-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-94571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-94572","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-74248","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","status":"published","published":"2026-08-14T20:20:31.446Z","modified":"2026-08-17T21:07:01.668Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:03.081354Z"}],"euvd":[{"id":"EUVD-2026-58807","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","status":"published","published":"2026-08-14T20:20:31Z","modified":"2026-08-17T21:07:01Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:48.026284Z"}],"ghsa":[{"id":"GHSA-3gfv-q5hp-jpcf","title":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By...","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","status":"published","published":"2026-08-14T21:31:36Z","modified":"2026-08-17T21:31:18Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:35.189726Z"}],"nvd":[{"id":"CVE-2026-74248","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","status":"published","published":"2026-08-14T21:17:58.173Z","modified":"2026-09-09T16:03:22.897Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:37.926464Z"}],"osv":[{"id":"DEBIAN-CVE-2026-74248","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","status":"published","published":"2026-08-14T21:17:58.173Z","modified":"2026-11-12T03:00:07.366941337Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-12T03:30:37.008994Z"},{"id":"UBUNTU-CVE-2026-74248","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","status":"published","published":"2026-08-14T21:17:00Z","modified":"2026-09-24T18:30:06.051030403Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"USN-8814-1","title":"octavia vulnerabilities","description":"It was discovered that Octavia did not properly validate TLS cipher\nstring fields in the Amphora provider driver. An authenticated\nattacker who owns a TLS-enabled load balancer could possibly use\nthis issue to inject arbitrary HAProxy configuration directives.\n(CVE-2026-94572)\n\nIt was discovered that Octavia did not properly validate L7 policy\nredirect URL fields in the Amphora provider driver. An authenticated\nattacker who owns a load balancer could possibly use this issue to\ninject arbitrary HAProxy configuration directives. (CVE-2026-94571)\n\nIt was discovered that Octavia incorrectly handled quality of service\npolicy authorization. An authenticated attacker could possibly use\nthis issue to prevent deletion of another project's QoS policy.\n(CVE-2026-74248)","status":"published","published":"2026-09-24T12:38:30Z","modified":"2026-09-25T00:43:09.032963047Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}