Medium severity · published Aug 14, 2026
CVE-2026-74248
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Octavia · OpenStack
before 16.0.2; 17.0.0; 18.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74248
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-74248
bugs.launchpad.net
https://bugs.launchpad.net/octavia/+bug/2161500
www.openwall.com
https://www.openwall.com/lists/oss-security/2026/08/13/12
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/08/17/2
More from Octavia
9.4
CVE-2026-94572
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters
9.4
CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields
8.0
CVE-2019-3895
An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director
7.5
CVE-2018-16856
In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log…