EUVD-2026-58807
GHSA-3gfv-q5hp-jpcf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Octavia API is network-accessible requiring valid tenant credentials (PR:L); cross-project policy lock-in produces partial integrity impact only, with no confidentiality or availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
AnalysisAI
QoS policy authorization bypass in OpenStack Octavia through version 18.0.0 permits authenticated tenant users to associate another project's Quality of Service policy with an amphora they control, blocking the legitimate policy owner from deleting that resource. The vendor confirms all Octavia deployments are affected, making this a universal tenant-isolation concern for multi-tenant OpenStack clouds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated OpenStack account with at minimum tenant-level privileges to create or modify amphorae in at least one project (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N correctly characterizes this as low-complexity, network-accessible, authenticated exploitation with only partial integrity impact and zero confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated tenant user on a shared OpenStack cloud obtains the UUID of a QoS policy belonging to a separate project - potentially through API enumeration if list permissions are permissive, or through prior knowledge. The attacker calls the Octavia API to associate that foreign QoS policy UUID with an amphora in their own project. … |
| Remediation | No vendor-released patched version with a confirmed fixed build number has been identified in the available intelligence at time of analysis; the references point to an upstream bug tracker (https://bugs.launchpad.net/octavia/+bug/2161500) and an oss-security disclosure (https://www.openwall.com/lists/oss-security/2026/08/13/12) rather than a tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the man
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Pla
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today