CVE-2026-55707

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

CVSS

No CVSS.

References

Link	Resource
https://launchpad.net/bugs/2152113
https://security.openstack.org/ossa/OSSA-2026-032.html
https://www.openwall.com/lists/oss-security/2026/07/29/5
http://www.openwall.com/lists/oss-security/2026/07/29/5
https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En OpenStack Neutron antes de 28.0.2, la API de incorporación de subnetpool no verifica la propiedad de las subredes objetivo. Un usuario autenticado puede incorporar subredes de la red compartida de otro proyecto a su propio subnetpool, mutando el estado de la subred de la víctima y alterando el enrutamiento L3 y el comportamiento del ámbito de direcciones para los routers de la víctima.

Information

Published : 2026-08-05 06:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-55707

Mitre link : CVE-2026-55707

CVE.ORG link : CVE-2026-55707

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-55707", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55707", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:00:38.952377Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"repo": "https://opendev.org/openstack/neutron", "vendor": "OpenStack", "product": "Neutron", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "26.0.6", "versionType": "semver"}, {"status": "affected", "version": "27.0.0", "lessThan": "27.0.4", "versionType": "semver"}, {"status": "affected", "version": "28.0.0", "lessThan": "28.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T06:16:37.903", "references": [{"url": "https://launchpad.net/bugs/2152113", "source": "cve@mitre.org"}, {"url": "https://security.openstack.org/ossa/OSSA-2026-032.html", "source": "cve@mitre.org"}, {"url": "https://www.openwall.com/lists/oss-security/2026/07/29/5", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/29/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers."}, {"lang": "es", "value": "En OpenStack Neutron antes de 28.0.2, la API de incorporaci\u00f3n de subnetpool no verifica la propiedad de las subredes objetivo. Un usuario autenticado puede incorporar subredes de la red compartida de otro proyecto a su propio subnetpool, mutando el estado de la subred de la v\u00edctima y alterando el enrutamiento L3 y el comportamiento del \u00e1mbito de direcciones para los routers de la v\u00edctima."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cve@mitre.org"}