CVE-2026-74248CWE-863broken-access-control

CVE-2026-74248

Medium · published August 15, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-15T01:17Z
References (4)
https://bugs.launchpad.net/octavia/+bug/2161500 · [email protected]https://www.openwall.com/lists/oss-security/2026/08/13/12 · [email protected]http://www.openwall.com/lists/oss-security/2026/08/17/2 · af854a3a-2127-422b-91ae-364da2661108https://bugs.launchpad.net/octavia/+bug/2161500 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 AUG 20:20Z
    OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization
    cvelistv5