CVE-2026-55707
CVE-2026-55707
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.
CVSS 7.1 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
neutron
- Versions du logiciel
- ≥ 14.0.0, < 26.0.6: Concernée (semver)
- ≥ 27.0.0, < 27.0.4: Concernée (semver)
- ≥ 28.0.0, < 28.0.2: Concernée (semver)
Mettez à jour vers 26.0.6; Mettez à jour vers 27.0.4; Mettez à jour vers 28.0.2
neutron Debian:12
- Versions du logiciel
- 2:21.0.0-7
- Plages de versions concernées
- ECOSYSTEM: < 2:21.0.0-7+deb12u1
Mettez à jour vers 2:21.0.0-7+deb12u1
neutron Debian:13
- Versions du logiciel
- 2:26.0.0-9
- 2:26.0.0-9+deb13u1
- 2:26.0.3-0+deb13u2
- Plages de versions concernées
- ECOSYSTEM: < 2:26.0.3-0+deb13u3
Mettez à jour vers 2:26.0.3-0+deb13u3
neutron Debian:14
- Versions du logiciel
- 2:26.0.0-9
- 2:27.0.0-1
- 2:27.0.0~rc1-1
- 2:27.0.0~rc1-2
- 2:27.0.1-1
- 2:27.0.1-2
- 2:27.0.1-3
- 2:27.0.1-4
- 2:27.0.1-5
- 2:27.0.1-6
- 2:28.0.0-1
- 2:28.0.0-2
- 2:28.0.0-3
- 2:28.0.0-4
- 2:28.0.0-5
- 2:28.0.0-6
- 2:28.0.0-7
- 2:28.0.0-8
- 2:28.0.0-9
- 2:28.0.0~rc1-1
- 2:28.0.0~rc1-2
- 2:28.0.0~rc2-1
- 2:28.0.0~rc2-2
- 2:28.0.1-1
- Plages de versions concernées
- ECOSYSTEM: < 2:28.0.1-2
Mettez à jour vers 2:28.0.1-2
neutron Ubuntu:16.04:LTS
- Versions du logiciel
- 2:7.0.0-0ubuntu1
- 2:8.0.0~b1-0ubuntu2
- 2:8.0.0~b2-0ubuntu4
- 2:8.0.0~b2-0ubuntu5
- 2:8.0.0~b2-0ubuntu7
- 2:8.0.0~b3-0ubuntu1
- 2:8.0.0~rc1-0ubuntu1
- 2:8.0.0-0ubuntu1
- 2:8.1.0-0ubuntu0.16.04.2
- 2:8.1.2-0ubuntu1
- 2:8.2.0-0ubuntu1
- 2:8.3.0-0ubuntu1
- 2:8.3.0-0ubuntu1.1
- 2:8.3.0-0ubuntu1.2
- 2:8.4.0-0ubuntu1
- 2:8.4.0-0ubuntu2
- 2:8.4.0-0ubuntu3
- 2:8.4.0-0ubuntu4
- 2:8.4.0-0ubuntu5
- 2:8.4.0-0ubuntu6
- 2:8.4.0-0ubuntu7.1
- 2:8.4.0-0ubuntu7.2
- 2:8.4.0-0ubuntu7.3
- 2:8.4.0-0ubuntu7.4
- 2:8.4.0-0ubuntu7.5
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
neutron Ubuntu:18.04:LTS
- Versions du logiciel
- 2:11.0.1-0ubuntu1
- 2:12.0.0~b1-0ubuntu1
- 2:12.0.0~b1-0ubuntu2
- 2:12.0.0~b2-0ubuntu1
- 2:12.0.0~b3-0ubuntu1
- 2:12.0.0~rc1-0ubuntu1
- 2:12.0.0~rc2-0ubuntu1
- 2:12.0.0-0ubuntu1
- 2:12.0.0-0ubuntu1.1
- 2:12.0.0-0ubuntu1.2
- 2:12.0.0-0ubuntu1.3
- 2:12.0.0-0ubuntu1.4
- 2:12.0.0-0ubuntu2
- 2:12.0.0-0ubuntu3
- 2:12.0.1-0ubuntu1
- 2:12.0.1-0ubuntu1.1
- 2:12.0.2-0ubuntu1
- 2:12.0.3-0ubuntu1
- 2:12.0.5-0ubuntu1
- 2:12.0.5-0ubuntu4
- 2:12.0.5-0ubuntu5
- 2:12.0.6-0ubuntu1
- 2:12.0.6-0ubuntu2
- 2:12.0.6-0ubuntu3
- 2:12.1.0-0ubuntu1
- 2:12.1.1-0ubuntu1
- 2:12.1.1-0ubuntu2
- 2:12.1.1-0ubuntu3
- 2:12.1.1-0ubuntu4
- 2:12.1.1-0ubuntu7
- 2:12.1.1-0ubuntu8
- 2:12.1.1-0ubuntu8.1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
neutron Ubuntu:20.04:LTS
- Versions du logiciel
- 2:15.0.0-0ubuntu1
- 2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1
- 2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1
- 2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3
- 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
- 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2
- 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3
- 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4
- 2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1
- 2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1
- 2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2
- 2:16.0.0-0ubuntu0.20.04.1
- 2:16.0.0-0ubuntu0.20.04.2
- 2:16.1.0-0ubuntu1
- 2:16.1.0-0ubuntu2
- 2:16.2.0-0ubuntu1
- 2:16.2.0-0ubuntu2
- 2:16.2.0-0ubuntu3
- 2:16.3.0-0ubuntu3
- 2:16.3.1-0ubuntu1
- 2:16.3.1-0ubuntu1.1
- 2:16.3.2-0ubuntu2
- 2:16.3.2-0ubuntu3
- 2:16.4.0-0ubuntu2
- 2:16.4.0-0ubuntu3
- 2:16.4.1-0ubuntu2
- 2:16.4.2-0ubuntu1
- 2:16.4.2-0ubuntu2
- 2:16.4.2-0ubuntu3
- 2:16.4.2-0ubuntu4
- 2:16.4.2-0ubuntu5
- 2:16.4.2-0ubuntu6
- 2:16.4.2-0ubuntu6.1
- 2:16.4.2-0ubuntu6.2
- 2:16.4.2-0ubuntu6.3
- 2:16.4.2-0ubuntu6.4
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
neutron Ubuntu:22.04:LTS
- Versions du logiciel
- 2:19.0.0-0ubuntu1
- 2:19.1.0+git2022030313.b072cbf05f-0ubuntu1
- 2:20.0.0-0ubuntu1
- 2:20.0.0-0ubuntu2
- 2:20.0.0-0ubuntu3
- 2:20.1.0-0ubuntu2
- 2:20.2.0-0ubuntu1
- 2:20.3.0-0ubuntu1
- 2:20.3.0-0ubuntu1.1
- 2:20.3.1-0ubuntu1
- 2:20.4.0-0ubuntu1
- 2:20.5.0-0ubuntu1
- 2:20.5.0-0ubuntu2
- 2:20.5.0-0ubuntu2.1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
neutron Ubuntu:24.04:LTS
- Versions du logiciel
- 2:23.0.0-0ubuntu1
- 2:24.0.0~b1+git2024011914.5ce17647-0ubuntu1
- 2:24.0.0~rc1-0ubuntu2
- 2:24.0.0-0ubuntu1
- 2:24.0.0-0ubuntu2
- 2:24.1.0-0ubuntu1
- 2:24.1.0-0ubuntu1.1
- 2:24.1.0-0ubuntu1.2
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
neutron Ubuntu:26.10
- Versions du logiciel
- 2:28.0.0-0ubuntu1
- 2:28.0.0-0ubuntu2
- 2:29.0.0~b1+git20260818.132.9aaa6fa-0ubuntu1
- 2:29.0.0~rc1-0ubuntu1
- 2:29.0.0-0ubuntu1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
neutron Ubuntu:26.04:LTS
- Versions du logiciel
- 2:27.0.0-0ubuntu1
- 2:28.0.0~b2+git20260121.28.762694d1bd-0ubuntu1
- 2:28.0.0~rc1-0ubuntu1
- 2:28.0.0~rc2-0ubuntu1
- 2:28.0.0-0ubuntu1
- 2:28.0.0-0ubuntu1.1
- 2:28.0.2-0ubuntu1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
Sources originales
- https://launchpad.net/bugs/2152113
- https://security.openstack.org/ossa/OSSA-2026-032.html
- https://www.openwall.com/lists/oss-security/2026/07/29/5
- http://www.openwall.com/lists/oss-security/2026/07/29/5
- https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-55707