CVE-2026-50266: OpenStack Neutron RBAC policy bypass in shared network ports

CVE-2026-50266 · Severity: low · CVSS 3.1 · Published 2026-06-04

OpenStack Neutron, the networking component for OpenStack cloud environments, contains a flaw in how it manages permissions for shared networks. A project manager could exploit this to gain unauthorized 'trusted' status for their network connections on a shared network they do not own. This could allow them to impersonate other users or bypass security protections, potentially leading to data interception or disruption of service for other tenants on the same network.

Technologies: OpenStack Neutron, neutron (PyPI). Vendors: OpenStack, PyPI.

Quick answers

Is CVE-2026-50266 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50266 being exploited in the wild.
How severe is CVE-2026-50266?
Low severity, with a CVSS score of 3.1, published 4 June 2026.
Which products and versions are affected?
OpenStack Neutron < 28.0.1, >=25.0.0 <25.2.4, >=26.0.0 <26.0.4, >=27.0.0 <27.0.3, ==28.0.0; neutron (PyPI) ECOSYSTEM:introduced=0,fixed=28.0.1.
Is there a fix for CVE-2026-50266?
Yes. neutron (PyPI): upgrade to 28.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50266 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50266?
Check whether you run OpenStack Neutron or neutron (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • neutron (PyPI): upgrade to 28.0.1 or later
    pip install "neutron>=28.0.1"

Technical details

An authorization bypass vulnerability exists in OpenStack Neutron's Role-Based Access Control (RBAC) policies. The default policy incorrectly allowed users with the PROJECT_MANAGER role to set the 'device_owner' attribute to 'network:*' values (e.g., 'network:dhcp') on shared networks, even if they did not own the network. Because 'network:' prefixed ports are treated as trusted system services, they often bypass security group rules and anti-spoofing protections (DHCP, MAC, and IP spoofing). This is a regression of a previous security fix. The issue is resolved in Neutron version 28.0.1 by requiring network ownership for project managers to set these trusted device owner values.

Affected products

  • OpenStack Neutron < 28.0.1

Identifiers

  • CVE-2026-50266
  • GHSA-qmc5-gv6v-8p22
  • PYSEC-2026-3491

Timeline

  • 2026-05-10: other: Bug reported to Launchpad
  • 2026-06-04: disclosed: Public disclosure and advisory published
  • 2026-06-04: advisory
  • 2026-07-15: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.