CVE-2026-55707

EUVD-2026-53046
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
7.1 HIGH
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.16%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openstackneutron
14.0.0 ≤
𝑥
< 26.0.6
CNA
openstackneutron
27.0.0 ≤
𝑥
< 27.0.4
CNA
openstackneutron
28.0.0 ≤
𝑥
< 28.0.2
CNA
Debian logo
Debian Releases
Debian Product
Codename
neutron
bookworm
vulnerable
bookworm (security)
2:21.0.0-7+deb12u1
fixed
forky
2:28.0.1-2
fixed
sid
2:28.0.1-2
fixed
trixie
2:26.0.3-0+deb13u3
fixed
trixie (security)
2:26.0.3-0+deb13u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
neutron
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://launchpad.net/bugs/2152113
https://security.openstack.org/ossa/OSSA-2026-032.html
https://www.openwall.com/lists/oss-security/2026/07/29/5
http://www.openwall.com/lists/oss-security/2026/07/29/5
https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html