CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of...
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
CVE-2026-55707- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-53046
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
EUVD-2026-53046- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-v5q5-3vcq-49r5
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of...
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
GHSA-v5q5-3vcq-49r5- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
CVE-2026-55707- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
CVE-2026-55707- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
DEBIAN-CVE-2026-55707- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-55707
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
- Record
UBUNTU-CVE-2026-55707- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neutronDebian:12 |
before 2:21.0.0-7+deb12u1, plus listed versions 2:21.0.0-7 |
2:21.0.0-7+deb12u1 |
neutronDebian:13 |
before 2:26.0.3-0+deb13u3, plus listed versions 2:26.0.0-92:26.0.0-9+deb13u12:26.0.3-0+deb13u2 |
2:26.0.3-0+deb13u3 |
neutronDebian:14 |
before 2:28.0.1-2, plus listed versions 2:26.0.0-92:27.0.0-12:27.0.0~rc1-12:27.0.0~rc1-22:27.0.1-1 Show 19 moreShow less2:27.0.1-22:27.0.1-32:27.0.1-42:27.0.1-52:27.0.1-62:28.0.0-12:28.0.0-22:28.0.0-32:28.0.0-42:28.0.0-52:28.0.0-62:28.0.0-72:28.0.0-82:28.0.0-92:28.0.0~rc1-12:28.0.0~rc1-22:28.0.0~rc2-12:28.0.0~rc2-22:28.0.1-1 |
2:28.0.1-2 |
neutronUbuntu:16.04:LTS |
All versions, plus listed versions 2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu22:8.0.0~b2-0ubuntu42:8.0.0~b2-0ubuntu52:8.0.0~b2-0ubuntu7 Show 20 moreShow less2:8.0.0~b3-0ubuntu12:8.0.0~rc1-0ubuntu12:8.0.0-0ubuntu12:8.1.0-0ubuntu0.16.04.22:8.1.2-0ubuntu12:8.2.0-0ubuntu12:8.3.0-0ubuntu12:8.3.0-0ubuntu1.12:8.3.0-0ubuntu1.22:8.4.0-0ubuntu12:8.4.0-0ubuntu22:8.4.0-0ubuntu32:8.4.0-0ubuntu42:8.4.0-0ubuntu52:8.4.0-0ubuntu62:8.4.0-0ubuntu7.12:8.4.0-0ubuntu7.22:8.4.0-0ubuntu7.32:8.4.0-0ubuntu7.42:8.4.0-0ubuntu7.5 |
None known |
neutronUbuntu:18.04:LTS |
All versions, plus listed versions 2:11.0.1-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b1-0ubuntu22:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu1 Show 27 moreShow less2:12.0.0~rc1-0ubuntu12:12.0.0~rc2-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu1.12:12.0.0-0ubuntu1.22:12.0.0-0ubuntu1.32:12.0.0-0ubuntu1.42:12.0.0-0ubuntu22:12.0.0-0ubuntu32:12.0.1-0ubuntu12:12.0.1-0ubuntu1.12:12.0.2-0ubuntu12:12.0.3-0ubuntu12:12.0.5-0ubuntu12:12.0.5-0ubuntu42:12.0.5-0ubuntu52:12.0.6-0ubuntu12:12.0.6-0ubuntu22:12.0.6-0ubuntu32:12.1.0-0ubuntu12:12.1.1-0ubuntu12:12.1.1-0ubuntu22:12.1.1-0ubuntu32:12.1.1-0ubuntu42:12.1.1-0ubuntu72:12.1.1-0ubuntu82:12.1.1-0ubuntu8.1 |
None known |
neutronUbuntu:20.04:LTS |
All versions, plus listed versions 2:15.0.0-0ubuntu12:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu12:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1 Show 31 moreShow less2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu22:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu32:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu42:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu12:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu22:16.0.0-0ubuntu0.20.04.12:16.0.0-0ubuntu0.20.04.22:16.1.0-0ubuntu12:16.1.0-0ubuntu22:16.2.0-0ubuntu12:16.2.0-0ubuntu22:16.2.0-0ubuntu32:16.3.0-0ubuntu32:16.3.1-0ubuntu12:16.3.1-0ubuntu1.12:16.3.2-0ubuntu22:16.3.2-0ubuntu32:16.4.0-0ubuntu22:16.4.0-0ubuntu32:16.4.1-0ubuntu22:16.4.2-0ubuntu12:16.4.2-0ubuntu22:16.4.2-0ubuntu32:16.4.2-0ubuntu42:16.4.2-0ubuntu52:16.4.2-0ubuntu62:16.4.2-0ubuntu6.12:16.4.2-0ubuntu6.22:16.4.2-0ubuntu6.32:16.4.2-0ubuntu6.4 |
None known |
neutronUbuntu:22.04:LTS |
All versions, plus listed versions 2:19.0.0-0ubuntu12:19.1.0+git2022030313.b072cbf05f-0ubuntu12:20.0.0-0ubuntu12:20.0.0-0ubuntu22:20.0.0-0ubuntu3 Show 9 moreShow less2:20.1.0-0ubuntu22:20.2.0-0ubuntu12:20.3.0-0ubuntu12:20.3.0-0ubuntu1.12:20.3.1-0ubuntu12:20.4.0-0ubuntu12:20.5.0-0ubuntu12:20.5.0-0ubuntu22:20.5.0-0ubuntu2.1 |
None known |
neutronUbuntu:24.04:LTS |
All versions, plus listed versions 2:23.0.0-0ubuntu12:24.0.0~b1+git2024011914.5ce17647-0ubuntu12:24.0.0~rc1-0ubuntu22:24.0.0-0ubuntu12:24.0.0-0ubuntu2 Show 4 moreShow less2:24.1.0-0ubuntu12:24.1.0-0ubuntu1.12:24.1.0-0ubuntu1.22:24.2.2-0ubuntu0.24.04.1 |
None known |
neutronUbuntu:26.10 |
All versions, plus listed versions 2:28.0.0-0ubuntu12:28.0.0-0ubuntu22:29.0.0~b1+git20260818.132.9aaa6fa-0ubuntu12:29.0.0~rc1-0ubuntu12:29.0.0-0ubuntu1 |
None known |
neutronUbuntu:26.04:LTS |
All versions, plus listed versions 2:27.0.0-0ubuntu12:28.0.0~b2+git20260121.28.762694d1bd-0ubuntu12:28.0.0~rc1-0ubuntu12:28.0.0~rc2-0ubuntu12:28.0.0-0ubuntu12:28.0.0-0ubuntu1.12:28.0.2-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55707 is a high vulnerability (CVSS 7.1) in Openstack Neutron, published August 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in neutron 2:21.0.0-7+deb12u1.