Skip to content
fr Sign in
7.1 High

CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets

Description

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

Affected products and versions

Product Affected versions Fixed in
Neutron 28.0 28.0.0 → < 28.0.2 28.0.2
Neutron 27.0 27.0.0 → < 27.0.4 27.0.4
Neutron 14.0 14.0.0 → < 26.0.6 26.0.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Neutron

The 4 CVEs of Neutron →
CVE-2026-50266 In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another… 2.2 Low CVE-2026-49299 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write… 5.3 Medium CVE-2024-53916 In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement 7.5 High
Track this CVE