CVE-2026-55707

EUVD-2026-53046
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openstackneutron
14.0.0 ≤
𝑥
< 26.0.6
CNA
openstackneutron
27.0.0 ≤
𝑥
< 27.0.4
CNA
openstackneutron
28.0.0 ≤
𝑥
< 28.0.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
neutron
bookworm
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
2:28.0.1-2
fixed
trixie
vulnerable
trixie (security)
vulnerable
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://launchpad.net/bugs/2152113
https://security.openstack.org/ossa/OSSA-2026-032.html
https://www.openwall.com/lists/oss-security/2026/07/29/5
http://www.openwall.com/lists/oss-security/2026/07/29/5