{"api_version":"1","generated_at":"2026-08-15T01:37:30+00:00","cve":"CVE-2026-74248","urls":{"html":"https://cve.report/CVE-2026-74248","api":"https://cve.report/api/cve/CVE-2026-74248.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74248","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74248"},"summary":{"title":"CVE-2026-74248","description":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","state":"PUBLISHED","assigner":"mitre","published_at":"2026-08-14 21:17:58","updated_at":"2026-08-14 21:17:58"},"problem_types":["CWE-863","CWE-863 CWE-863 Incorrect Authorization"],"metrics":[{"version":"3.1","source":"cve@mitre.org","type":"Secondary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://bugs.launchpad.net/octavia/+bug/2161500","name":"https://bugs.launchpad.net/octavia/+bug/2161500","refsource":"cve@mitre.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.openwall.com/lists/oss-security/2026/08/13/12","name":"https://www.openwall.com/lists/oss-security/2026/08/13/12","refsource":"cve@mitre.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74248","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74248","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"OpenStack","product":"Octavia","version":"affected 16.0.2 semver","platforms":[]},{"source":"CNA","vendor":"OpenStack","product":"Octavia","version":"affected 17.0.0 semver","platforms":[]},{"source":"CNA","vendor":"OpenStack","product":"Octavia","version":"affected 18.0.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Octavia","vendor":"OpenStack","versions":[{"lessThan":"16.0.2","status":"affected","version":"0","versionType":"semver"},{"status":"affected","version":"17.0.0","versionType":"semver"},{"status":"affected","version":"18.0.0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*","versionEndExcluding":"16.0.2","vulnerable":true},{"criteria":"cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*","versionEndIncluding":"17.0.0","versionStartIncluding":"17.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*","versionEndIncluding":"18.0.0","versionStartIncluding":"18.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-14T20:20:31.446Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"url":"https://bugs.launchpad.net/octavia/+bug/2161500"},{"url":"https://www.openwall.com/lists/oss-security/2026/08/13/12"}],"x_generator":{"engine":"CVE-Request-form 0.0.1"}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2026-74248","datePublished":"2026-08-14T20:20:31.446Z","dateReserved":"2026-08-14T20:20:31.038Z","dateUpdated":"2026-08-14T20:20:31.446Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-14 21:17:58","lastModifiedDate":"2026-08-14 21:17:58","problem_types":["CWE-863","CWE-863 CWE-863 Incorrect Authorization"],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74248","Ordinal":"1","Title":"CVE-2026-74248","CVE":"CVE-2026-74248","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74248","Ordinal":"1","NoteData":"OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.","Type":"Description","Title":"CVE-2026-74248"}]}}}