Executive brief
OpenStack Neutron is the networking service that manages virtual networks and subnets in cloud deployments. An authenticated user in one project can manipulate another project's shared network subnets by assigning them to their own network pool, potentially disrupting routing, address translation, and network isolation for victim deployments. This is a cross-project trust boundary violation affecting organizations using shared networks.
Technical details
The vulnerability is an authorization bypass in Neutron's subnetpool onboarding API (PUT /v2.0/subnetpools/{id}/onboard_network_subnets). The API checks only that the target network is visible to the caller, but fails to verify ownership of the subnets before onboarding them into the attacker's subnetpool. An authenticated, non-admin user can exploit this to onboard subnets from another project's RBAC-shared or globally-shared networks, mutating the victim subnet's subnetpool_id and address-scope associations. This allows attackers to alter L3 routing, NAT behavior, and address-scope handling for victim routers, potentially causing denial of service or routing bypasses. Patches are available in Neutron 26.0.6, 27.0.4, and 28.0.2, and affect versions ≥14.0.0 prior to these releases.
Affected products
- OpenStack Neutron >=14.0.0 <26.0.6, >=27.0.0 <27.0.4, >=28.0.0 <28.0.2
Timeline
- 2026-07-29: disclosed: OSSA-2026-032 published
- 2026-08-05: patched: CVE-2026-55707 assigned
- 2026-05-10: other: Vulnerability reported by Tim Shephard