Vulnerability details
CVE-2026-55707
OpenStack Neutron
CVSS 4.0
7.1High
Official description
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (mitre) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| OpenStack | Neutron | 14.0.0 ≤ v < 26.0.6 | CVEProject cvelistV5 (CNA) |
| OpenStack | Neutron | 27.0.0 ≤ v < 27.0.4 | CVEProject cvelistV5 (CNA) |
| OpenStack | Neutron | 28.0.0 ≤ v < 28.0.2 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://launchpad.net/bugs/2152113 issue-tracking
- https://security.openstack.org/ossa/OSSA-2026-032.html vendor-advisory
- https://www.openwall.com/lists/oss-security/2026/07/29/5 vendor-advisorymailing-list
- http://www.openwall.com/lists/oss-security/2026/07/29/5
- https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-05
- Last updated
- 2026-08-12
- State
- Published
- Assigner (CNA)
- mitre
Exploit prediction (EPSS)
0.42%
Probability of exploitation in 30 days
37.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-863Incorrect Authorization