oss-security - [OSSA-2026-016] OpenStack Neutron: Tagging policy bypass allows project readers to mutate tags (CVE-2026-pending)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a8a9d885-ae9a-40e1-940f-05329c8e9755@gmail.com>
Date: Thu, 28 May 2026 10:00:45 -0700
From: Goutham Pacha Ravi <gouthampravi@...il.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2026-016] OpenStack Neutron: Tagging policy bypass allows
 project readers to mutate tags (CVE-2026-pending)

==================================================================================
OSSA-2026-016: Neutron tagging policy bypass allows project readers to 
mutate tags
==================================================================================

:Date: May 28, 2026
:CVE: CVE-2026-pending


Affects
~~~~~~~
- Neutron: >=26.0.0 <26.0.4, >=27.0.0 <27.0.3, >=28.0.0 <28.0.1


Description
~~~~~~~~~~~
Tim Shephard from roiai.ca reported a policy enforcement bypass in 
Neutron's tagging controller. The controller enforces plural policy 
action names on single-tag write operations while the defined policy 
rules use singular names. The mismatched names evaluate as allowed under 
default policy, permitting a project reader to create and update tags on 
same-project resources. Deployments running Neutron 26.0.0 or later are 
affected.



Patches
~~~~~~~
- https://review.opendev.org/989376 (2025.1/epoxy)
- https://review.opendev.org/989375 (2025.2/flamingo)
- https://review.opendev.org/989374 (2026.1/gazpacho)
- https://review.opendev.org/989099 (2026.2/hibiscus)


Credits
~~~~~~~
- Tim Shephard from roiai.ca (CVE-2026-pending)


References
~~~~~~~~~~
- https://launchpad.net/bugs/2150132
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending


Notes
~~~~~
- CVE assignment is pending (MITRE CAN-2026-2030611).


--
Goutham Pacha Ravi (gouthamr)
OpenStack Vulnerability Management Team
https://security.openstack.org/vmt.html

Download attachment "OpenPGP_0x0638DAD3B82C3988.asc" of type "application/pgp-keys" (3241 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.