DEBIAN-CVE-2026-74248

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-74248
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-74248.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-74248
Upstream
  • CVE-2026-74248
Published
2026-08-14T21:17:58Z
Modified
2026-09-10T08:47:26Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

References

Affected packages

Debian:12 / octavia

Package

Name
octavia
Purl
pkg:deb/debian/octavia?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

11.*
11.0.0-2
12.*
12.0.0~rc1-1
12.0.0~rc2-1
12.0.0-1
12.0.0-2
12.0.0-3
12.0.0-4
13.*
13.0.0~rc1-1
13.0.0-1
13.0.0-2
14.*
14.0.0~rc1-1
14.0.0-1
14.0.0-2
14.0.0-3
14.0.0-4
15.*
15.0.0~rc1-1
15.0.0~rc1-2
15.0.0~rc1-3
15.0.0-1
15.0.0-2
15.0.0-3
16.*
16.0.0~rc1-1
16.0.0~rc1-2
16.0.0-1
16.0.0-2
16.0.0-3
17.*
17.0.0~rc1-1
17.0.0~rc2-1
17.0.0~rc2-2
17.0.0~rc2-3
17.0.0-1
17.0.0-2
17.0.0-3
17.0.0-4
17.0.0-5
18.*
18.0.0~rc1-1
18.0.0~rc1-2
18.0.0-1
18.0.0-2
18.0.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-74248.json"

Debian:13 / octavia

Package

Name
octavia
Purl
pkg:deb/debian/octavia?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

16.*
16.0.0-2
16.0.0-3
17.*
17.0.0~rc1-1
17.0.0~rc2-1
17.0.0~rc2-2
17.0.0~rc2-3
17.0.0-1
17.0.0-2
17.0.0-3
17.0.0-4
17.0.0-5
18.*
18.0.0~rc1-1
18.0.0~rc1-2
18.0.0-1
18.0.0-2
18.0.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-74248.json"

Debian:14 / octavia

Package

Name
octavia
Purl
pkg:deb/debian/octavia?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
18.0.0-3

Affected versions

16.*
16.0.0-2
16.0.0-3
17.*
17.0.0~rc1-1
17.0.0~rc2-1
17.0.0~rc2-2
17.0.0~rc2-3
17.0.0-1
17.0.0-2
17.0.0-3
17.0.0-4
17.0.0-5
18.*
18.0.0~rc1-1
18.0.0~rc1-2
18.0.0-1
18.0.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-74248.json"