Aller au contenu
en Se connecter
7.1 Élevée

CVE-2026-55707 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets

Description

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

Produits et versions touchés

Produit Versions touchées Corrigé en
Neutron 28.0 28.0.0 → < 28.0.2 28.0.2
Neutron 27.0 27.0.0 → < 27.0.4 27.0.4
Neutron 14.0 14.0.0 → < 26.0.6 26.0.6

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Neutron

Les 4 CVE de Neutron →
CVE-2026-50266 In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another… 2.2 Faible CVE-2026-49299 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write… 5.3 Moyenne CVE-2024-53916 In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement 7.5 Élevée
Suivre cette CVE