CVE-2026-74248
Fixed in a distro release EPSS <1%CVSS 4.3
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
Products: openstack octavia
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | octavia | no fix |
| Debian 13 | octavia | no fix |
| Debian 14 | octavia | 18.0.0-3 |
| Ubuntu 20.04 LTS | octavia | no fix |
| Ubuntu 22.04 LTS | octavia | 1:10.1.1-0ubuntu1.5 |
| Ubuntu 24.04 LTS | octavia | 1:14.0.0-0ubuntu1.6 |
| Ubuntu 26.04 LTS | octavia | 1:18.0.0-0ubuntu2.1 |