CVE-2026-49299: OpenStack Neutron has an Incorrect Authorization issue

May 29, 2026 (updated July 2, 2026)

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

References

bugs.launchpad.net/bugs/2150132
github.com/advisories/GHSA-xv24-hxh9-2hh9
nvd.nist.gov/vuln/detail/CVE-2026-49299
review.opendev.org/c/openstack/neutron/+/989099
www.openwall.com/lists/oss-security/2026/05/28/8

Code Behaviors & Features

Detect and mitigate CVE-2026-49299 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →