CVE-2026-74248 in Octavia
Summary
by MITRE • 08/14/2026
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in OpenStack Octavia affects versions through 18.0.0 and represents a critical authorization flaw in the quality of service policy management system. This issue stems from improper validation of cross-project resource associations, specifically allowing authenticated users to bind QoS policies from one project to amphora instances belonging to another project. The technical implementation fails to enforce proper project isolation boundaries during QoS policy attachment operations, creating a scenario where privilege escalation can occur through unauthorized resource association.
The operational impact of this vulnerability extends beyond simple authorization bypass as it fundamentally undermines the integrity of QoS policy management within OpenStack deployments. When an authenticated user successfully associates another project's QoS policy with their amphora instance, they effectively gain the ability to prevent deletion of that policy by its legitimate owner. This creates a persistent denial of service condition where the original policy owner cannot remove or modify their own QoS policy, effectively locking it in place until the malicious association is manually removed. The vulnerability affects all Octavia deployments regardless of configuration or security settings, making it particularly concerning for multi-tenant environments.
This flaw aligns with CWE-285 (Improper Authorization) and represents a specific instance of inadequate access control mechanisms within cloud orchestration platforms. The vulnerability enables attackers to maintain persistent control over QoS policy resources through unauthorized association patterns that bypass normal project-based access controls. From an ATT&CK perspective, this maps to privilege escalation techniques using resource manipulation and persistence mechanisms, specifically targeting the credential access and defense evasion domains. The issue particularly affects cloud environments where multiple projects share the same Octavia service, creating potential for cross-project interference and resource contention.
Mitigation strategies should focus on implementing proper project boundary validation during QoS policy attachment operations and enforcing strict authorization checks before allowing any cross-project resource associations. Deployments should update to patched versions of Octavia that address the underlying authorization logic and implement additional monitoring for unusual QoS policy association patterns. Administrators should also consider implementing stricter network segmentation policies and regular audits of QoS policy attachments to detect unauthorized cross-project associations. The vulnerability highlights the importance of proper resource isolation mechanisms in multi-tenant cloud environments and underscores the need for comprehensive authorization testing across all cloud orchestration components.