CVE-2026-49299

Vulnerability

The Neutron tagging controller in OpenStack Neutron before versions 28.0.1, 27.0.3, and 26.0.4 enforces plural policy action names (e.g., create_networks:tags) on single-tag write operations (POST/PUT to /.../tags and /.../tags/{tag}), while the defined policy rules use singular names (e.g., create_network:tags). This mismatch causes the plural names to evaluate as allowed under the default policy, bypassing the intended singular restrictions. The bug lives in neutron/neutron/extensions/tagging.py at lines 224 and 241, where it constructs action names from the pluralized resource type (rinfo.obj_type values like networks, ports, floatingips). Affected deployments run Neutron 26.0.0 or later, up to the fixed versions [1][2].

Exploitation

An attacker needs network access to the Neutron API and a valid project reader role (or any role with read access on the same project). No additional authentication or user interaction is required. The attacker sends a POST request to /networks/{network_id}/tags with a JSON body containing a single tag string (e.g., {"tags": ["reader-post"]}). The controller responds with 200 OK and the tag is created. Similarly, a PUT request to /networks/{network_id}/tags/{tag} with the same tag string creates or updates that tag. The attacker can repeat these operations to mutate tags on any network, port, or floating IP resource within their project. The bulk path /networks/{network_id}/tags.json remains correctly denied under the singular policy rules [1][2].

Impact

A project reader gains the ability to create and update tags on same-project network, port, and floating IP resources, which should be restricted to project members or admins. This violates the intended access control policy and could lead to unauthorized metadata changes, potentially affecting resource classification, network segmentation, or other tag-dependent operations. The privilege escalation is limited to tag mutation within the attacker's project; no cross-project or admin-level access is achieved.

Mitigation

Fixed versions are Neutron 28.0.1, 27.0.3, and 26.0.4, released on 2026-05-28. The fix aligns the controller action names with the singular policy names by modifying neutron/neutron/extensions/tagging.py to use the singular form. Deployments should upgrade to these versions. No workaround exists; the bug is inherent in the controller design. The vulnerability is not listed in KEV as of this writing [1][2].