CVE-2026-74248

MediumCVSS 4.3

Published: 14/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

OpenStack Octavia through 18.0.0 mishandles QoS policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy.

Risk Assessment

This could lead to disruption in QoS policy management and potentially cause availability or security issues.

Recommendation

Update OpenStack Octavia to a patched version and monitor QoS policy permissions.

Original NVD description (English source)

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.