Skip to content
fr Sign in
2.2 Low

CVE-2026-50266 In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another…

Description

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

Affected products and versions

Product Affected versions Fixed in
Neutron 28.0 28.0.0 → < 28.0.1 28.0.1
Neutron 27.0 27.0.0 → < 27.0.3 27.0.3
Neutron 26.0 26.0.0 → < 26.0.4 26.0.4
Neutron 25.0 25.0.0 → < 25.2.4 25.2.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Neutron

The 4 CVEs of Neutron →
CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets 7.1 High CVE-2026-49299 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write… 5.3 Medium CVE-2024-53916 In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement 7.5 High
Track this CVE