Description

OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-14T21:17:58.173Z",
  "pubdate": "2026-08-14T21:17:58.173Z",
  "executiveSummary": "OpenStack Octavia through versions up to 18.0.0 suffers from an authorization vulnerability related to quality of service (QoS) policy management. The flaw allows authenticated users to associate QoS policies belonging to other isolated projects with their own provisioned amphora instances. This improper handling of cross-project resource references breaks object dependency tracking and ownership validation logic within the service.\nThe primary operational impact of this vulnerability is a denial-of-service condition against administrative and legitimate tenant workflows, specifically by preventing the deletion of targeted QoS policies that are falsely referenced by foreign resources. Exploitation of this issue requires valid user authentication within the OpenStack environment, enabling an attacker with standard tenant privileges to target arbitrary project resources. All deployments running vulnerable versions of OpenStack Octavia are susceptible to this authorization enforcement failure, posing risks to multi-tenant resource isolation and overall cloud infrastructure stability.",
  "technicalDetails": "The vulnerability stems from insufficient access control enforcement and cross-project validation checks during the association of quality of service (QoS) policies to amphora instances within OpenStack Octavia through 18.0.0. Specifically, the vulnerable component fails to properly verify whether the authenticated user initiating the association holds ownership or administrative privileges over the target QoS policy residing in a distinct project namespace.\nThe attack flow proceeds as follows: First, an authenticated attacker identifies or enumerates a QoS policy UUID belonging to a different OpenStack project. Second, the attacker interacts with the Octavia API to provision or update an amphora associated with their own tenant, explicitly supplying the foreign QoS policy UUID within the configuration payload. Third, Octavia processes the association request without adequately validating cross-project ownership boundaries, successfully binding the foreign policy to the attacker-controlled amphora.\nAs a direct consequence of this unauthorized association, backend relationship references and dependency tracking mechanisms register an active dependency between the amphora and the victim project's QoS policy. When the legitimate owner or an administrator subsequently attempts to delete the affected QoS policy, the API enforces dependency constraints to prevent deletion of resources that are currently in use, resulting in an operational denial of service.\nThe vulnerability requires network exposure to the OpenStack Octavia API endpoints, authenticated user status within the platform, and standard tenant-level privileges. No complex payload behavior or execution of arbitrary code is required; the impact is strictly logical, abusing missing authorization checks within resource binding workflows to cause persistent resource locking and state corruption across tenant boundaries."
}