CVE-2026-49299: OpenStack Neutron has an Incorrect Authorization issue

May 29, 2026 (updated July 2, 2026)

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

References

bugs.launchpad.net/bugs/2150132
github.com/advisories/GHSA-xv24-hxh9-2hh9
nvd.nist.gov/vuln/detail/CVE-2026-49299
review.opendev.org/c/openstack/neutron/+/989099
www.openwall.com/lists/oss-security/2026/05/28/8

Code Behaviors & Features

Detect and mitigate CVE-2026-49299 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →