Aller au contenu
en Se connecter
2.2 Faible

CVE-2026-50266 In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another…

Description

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

Produits et versions touchés

Produit Versions touchées Corrigé en
Neutron 28.0 28.0.0 → < 28.0.1 28.0.1
Neutron 27.0 27.0.0 → < 27.0.3 27.0.3
Neutron 26.0 26.0.0 → < 26.0.4 26.0.4
Neutron 25.0 25.0.0 → < 25.2.4 25.2.4

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Neutron

Les 4 CVE de Neutron →
CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets 7.1 Élevée CVE-2026-49299 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write… 5.3 Moyenne CVE-2024-53916 In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement 7.5 Élevée
Suivre cette CVE