UBUNTU-CVE-2026-49299
- Source
- https://ubuntu.com/security/CVE-2026-49299
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-49299.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-49299
- Upstream
- Published
- 2026-05-28T22:17:00Z
- Modified
- 2026-06-03T11:26:16Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.
- References
Affected packages
Ubuntu:16.04:LTS
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:7.*
2:7.0.0-0ubuntu1
2:8.*
2:8.0.0~b1-0ubuntu2
2:8.0.0~b2-0ubuntu4
2:8.0.0~b2-0ubuntu5
2:8.0.0~b2-0ubuntu7
2:8.0.0~b3-0ubuntu1
2:8.0.0~rc1-0ubuntu1
2:8.0.0-0ubuntu1
2:8.1.0-0ubuntu0.16.04.2
2:8.1.2-0ubuntu1
2:8.2.0-0ubuntu1
2:8.3.0-0ubuntu1
2:8.3.0-0ubuntu1.1
2:8.3.0-0ubuntu1.2
2:8.4.0-0ubuntu1
2:8.4.0-0ubuntu2
2:8.4.0-0ubuntu3
2:8.4.0-0ubuntu4
2:8.4.0-0ubuntu5
2:8.4.0-0ubuntu6
2:8.4.0-0ubuntu7.1
2:8.4.0-0ubuntu7.2
2:8.4.0-0ubuntu7.3
2:8.4.0-0ubuntu7.4
2:8.4.0-0ubuntu7.5
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-bgp-dragent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-common"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-linuxbridge-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-plugin-linuxbridge-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-plugin-openvswitch-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-plugin-sriov-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-server"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:8.4.0-0ubuntu7.5",
"binary_name": "python-neutron"
}
]
}Ubuntu:18.04:LTS
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=bionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:11.*
2:11.0.1-0ubuntu1
2:12.*
2:12.0.0~b1-0ubuntu1
2:12.0.0~b1-0ubuntu2
2:12.0.0~b2-0ubuntu1
2:12.0.0~b3-0ubuntu1
2:12.0.0~rc1-0ubuntu1
2:12.0.0~rc2-0ubuntu1
2:12.0.0-0ubuntu1
2:12.0.0-0ubuntu1.1
2:12.0.0-0ubuntu1.2
2:12.0.0-0ubuntu1.3
2:12.0.0-0ubuntu1.4
2:12.0.0-0ubuntu2
2:12.0.0-0ubuntu3
2:12.0.1-0ubuntu1
2:12.0.1-0ubuntu1.1
2:12.0.2-0ubuntu1
2:12.0.3-0ubuntu1
2:12.0.5-0ubuntu1
2:12.0.5-0ubuntu4
2:12.0.5-0ubuntu5
2:12.0.6-0ubuntu1
2:12.0.6-0ubuntu2
2:12.0.6-0ubuntu3
2:12.1.0-0ubuntu1
2:12.1.1-0ubuntu1
2:12.1.1-0ubuntu2
2:12.1.1-0ubuntu3
2:12.1.1-0ubuntu4
2:12.1.1-0ubuntu7
2:12.1.1-0ubuntu8
2:12.1.1-0ubuntu8.1
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-common"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-linuxbridge-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-plugin-linuxbridge-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-plugin-openvswitch-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-plugin-sriov-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-server"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:12.1.1-0ubuntu8.1",
"binary_name": "python-neutron"
}
]
}Ubuntu:20.04:LTS
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=focal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:15.*
2:15.0.0-0ubuntu1
2:16.*
2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1
2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1
2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3
2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4
2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1
2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1
2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2
2:16.0.0-0ubuntu0.20.04.1
2:16.0.0-0ubuntu0.20.04.2
2:16.1.0-0ubuntu1
2:16.1.0-0ubuntu2
2:16.2.0-0ubuntu1
2:16.2.0-0ubuntu2
2:16.2.0-0ubuntu3
2:16.3.0-0ubuntu3
2:16.3.1-0ubuntu1
2:16.3.1-0ubuntu1.1
2:16.3.2-0ubuntu2
2:16.3.2-0ubuntu3
2:16.4.0-0ubuntu2
2:16.4.0-0ubuntu3
2:16.4.1-0ubuntu2
2:16.4.2-0ubuntu1
2:16.4.2-0ubuntu2
2:16.4.2-0ubuntu3
2:16.4.2-0ubuntu4
2:16.4.2-0ubuntu5
2:16.4.2-0ubuntu6
2:16.4.2-0ubuntu6.1
2:16.4.2-0ubuntu6.2
2:16.4.2-0ubuntu6.3
2:16.4.2-0ubuntu6.4
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-common"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-linuxbridge-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-ovn-metadata-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-server"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:16.4.2-0ubuntu6.4",
"binary_name": "python3-neutron"
}
]
}Ubuntu:22.04:LTS
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:19.*
2:19.0.0-0ubuntu1
2:19.1.0+git2022030313.b072cbf05f-0ubuntu1
2:20.*
2:20.0.0-0ubuntu1
2:20.0.0-0ubuntu2
2:20.0.0-0ubuntu3
2:20.1.0-0ubuntu2
2:20.2.0-0ubuntu1
2:20.3.0-0ubuntu1
2:20.3.0-0ubuntu1.1
2:20.3.1-0ubuntu1
2:20.4.0-0ubuntu1
2:20.5.0-0ubuntu1
2:20.5.0-0ubuntu2
2:20.5.0-0ubuntu2.1
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-common"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-linuxbridge-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-ovn-metadata-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-server"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:20.5.0-0ubuntu2.1",
"binary_name": "python3-neutron"
}
]
}Ubuntu:24.04:LTS
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=noble
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:23.*
2:23.0.0-0ubuntu1
2:24.*
2:24.0.0~b1+git2024011914.5ce17647-0ubuntu1
2:24.0.0~rc1-0ubuntu2
2:24.0.0-0ubuntu1
2:24.0.0-0ubuntu2
2:24.1.0-0ubuntu1
2:24.1.0-0ubuntu1.1
2:24.1.0-0ubuntu1.2
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-common"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-linuxbridge-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-ovn-metadata-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-server"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:24.1.0-0ubuntu1.2",
"binary_name": "python3-neutron"
}
]
}Ubuntu:25.10
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=questing
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:26.*
2:26.0.0-0ubuntu1
2:26.0.1+git2025070714.71962255de-0ubuntu1
2:26.0.1+git2025070714.71962255de-0ubuntu2
2:27.*
2:27.0.0~rc1-0ubuntu1
2:27.0.0-0ubuntu1
2:27.0.0-0ubuntu1.1
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-api"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-common"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-ovn-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-ovn-maintenance-worker"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-ovn-metadata-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-periodic-workers"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-rpc-server"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-server"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:27.0.0-0ubuntu1.1",
"binary_name": "python3-neutron"
}
]
}Ubuntu:26.04:LTS
neutron
Package
- Name
- neutron
- Purl
- pkg:deb/ubuntu/neutron?arch=source&distro=resolute
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
2:27.*
2:27.0.0-0ubuntu1
2:28.*
2:28.0.0~b2+git20260121.28.762694d1bd-0ubuntu1
2:28.0.0~rc1-0ubuntu1
2:28.0.0~rc2-0ubuntu1
2:28.0.0-0ubuntu1
Ecosystem specific
{
"binaries": [
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-api"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-common"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-dhcp-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-l3-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-macvtap-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-metadata-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-metering-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-openvswitch-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-ovn-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-ovn-maintenance-worker"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-ovn-metadata-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-periodic-workers"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-plugin-ml2"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-rpc-server"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-server"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "neutron-sriov-agent"
},
{
"binary_version": "2:28.0.0-0ubuntu1",
"binary_name": "python3-neutron"
}
]
}