Skip to content
Fencer Vulns
medium 4.3

CVE-2026-74248 json

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization.

published 2026-08-14 2 mo ago modified 2026-09-09 1 mo ago also EUVD-2026-58807

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

Patch / fix

  • OpenStack Octavia 16.0.2
  • octavia Debian 14 18.0.0-3

debian advisories DEBIAN-CVE-2026-74248

  • octavia Ubuntu 22.04 LTS 1:10.1.1-0ubuntu1.5
  • octavia Ubuntu 24.04 LTS 1:14.0.0-0ubuntu1.6
  • octavia Ubuntu 26.04 LTS 1:18.0.0-0ubuntu2.1

ubuntu advisories UBUNTU-CVE-2026-74248

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-74248 updated cvss 4.3

octavia: OpenStack Octavia: Authenticated user can prevent QoS policy deletion

  • Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-octavia-api, rhosp-rhel8/openstack-octavia-base, rhosp-rhel8/openstack-octavia-worker, rhosp-rhel8/openstack-octavia-housekeeping, rhosp-rhel8/openstack-octavia-health-manager Red Hat OpenStack Platform 18.0 rhoso/openstack-octavia-api-rhel9, rhoso/openstack-octavia-base-rhel9, rhoso/openstack-octavia-worker-rhel9, rhoso/openstack-octavia-housekeeping-rhel9, rhoso/openstack-octavia-health-manager-rhel9
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.launchpad.net https://bugs.launchpad.net/octavia/+bug/2161500 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

  • OpenStack Octavia

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.