https://seclists.org/oss-sec/2026/q3/486: [OSSA-2026-035] OpenStack Octavia: Unauthorized QoS policy deletion lock (CVE pending)

Q: Which Octavia versions are affected?

Octavia versions earlier than 16.0.2, as well as 17.0.0 and 18.0.0, are listed as affected.

Q: Which release branches have patches available?

Patches are listed for 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and the 2026.2/hibiscus development branch.

Q: Is there an assigned CVE identifier?

No. A CVE assignment was requested from MITRE on August 5, 2026, and the advisory states that it will be updated through an errata publication once an ID is available.

Published Aug 13, 2026

Updated

Affected Software

3 affected components

Openstack Octavia>16.0.2<=17.0.0

Openstack Octavia=17.0.0

Openstack Octavia=18.0.0

Frequently Asked Questions

Which Octavia versions are affected?

Octavia versions earlier than 16.0.2, as well as 17.0.0 and 18.0.0, are listed as affected.

Which release branches have patches available?

Patches are listed for 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and the 2026.2/hibiscus development branch.

Is there an assigned CVE identifier?

No. A CVE assignment was requested from MITRE on August 5, 2026, and the advisory states that it will be updated through an errata publication once an ID is available.