p PatchFirst

CVE-2026-55707

CVE-2026-55707

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • neutron

    Versions
    • ≥ 14.0.0, < 26.0.6: Affected (semver)
    • ≥ 27.0.0, < 27.0.4: Affected (semver)
    • ≥ 28.0.0, < 28.0.2: Affected (semver)

    Update to 26.0.6; Update to 27.0.4; Update to 28.0.2

  • neutron Debian:12

    Versions
    • 2:21.0.0-7
    Affected ranges
    • ECOSYSTEM: < 2:21.0.0-7+deb12u1

    Update to 2:21.0.0-7+deb12u1

  • neutron Debian:13

    Versions
    • 2:26.0.0-9
    • 2:26.0.0-9+deb13u1
    • 2:26.0.3-0+deb13u2
    Affected ranges
    • ECOSYSTEM: < 2:26.0.3-0+deb13u3

    Update to 2:26.0.3-0+deb13u3

  • neutron Debian:14

    Versions
    • 2:26.0.0-9
    • 2:27.0.0-1
    • 2:27.0.0~rc1-1
    • 2:27.0.0~rc1-2
    • 2:27.0.1-1
    • 2:27.0.1-2
    • 2:27.0.1-3
    • 2:27.0.1-4
    • 2:27.0.1-5
    • 2:27.0.1-6
    • 2:28.0.0-1
    • 2:28.0.0-2
    • 2:28.0.0-3
    • 2:28.0.0-4
    • 2:28.0.0-5
    • 2:28.0.0-6
    • 2:28.0.0-7
    • 2:28.0.0-8
    • 2:28.0.0-9
    • 2:28.0.0~rc1-1
    • 2:28.0.0~rc1-2
    • 2:28.0.0~rc2-1
    • 2:28.0.0~rc2-2
    • 2:28.0.1-1
    Affected ranges
    • ECOSYSTEM: < 2:28.0.1-2

    Update to 2:28.0.1-2

  • neutron Ubuntu:16.04:LTS

    Versions
    • 2:7.0.0-0ubuntu1
    • 2:8.0.0~b1-0ubuntu2
    • 2:8.0.0~b2-0ubuntu4
    • 2:8.0.0~b2-0ubuntu5
    • 2:8.0.0~b2-0ubuntu7
    • 2:8.0.0~b3-0ubuntu1
    • 2:8.0.0~rc1-0ubuntu1
    • 2:8.0.0-0ubuntu1
    • 2:8.1.0-0ubuntu0.16.04.2
    • 2:8.1.2-0ubuntu1
    • 2:8.2.0-0ubuntu1
    • 2:8.3.0-0ubuntu1
    • 2:8.3.0-0ubuntu1.1
    • 2:8.3.0-0ubuntu1.2
    • 2:8.4.0-0ubuntu1
    • 2:8.4.0-0ubuntu2
    • 2:8.4.0-0ubuntu3
    • 2:8.4.0-0ubuntu4
    • 2:8.4.0-0ubuntu5
    • 2:8.4.0-0ubuntu6
    • 2:8.4.0-0ubuntu7.1
    • 2:8.4.0-0ubuntu7.2
    • 2:8.4.0-0ubuntu7.3
    • 2:8.4.0-0ubuntu7.4
    • 2:8.4.0-0ubuntu7.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neutron Ubuntu:18.04:LTS

    Versions
    • 2:11.0.1-0ubuntu1
    • 2:12.0.0~b1-0ubuntu1
    • 2:12.0.0~b1-0ubuntu2
    • 2:12.0.0~b2-0ubuntu1
    • 2:12.0.0~b3-0ubuntu1
    • 2:12.0.0~rc1-0ubuntu1
    • 2:12.0.0~rc2-0ubuntu1
    • 2:12.0.0-0ubuntu1
    • 2:12.0.0-0ubuntu1.1
    • 2:12.0.0-0ubuntu1.2
    • 2:12.0.0-0ubuntu1.3
    • 2:12.0.0-0ubuntu1.4
    • 2:12.0.0-0ubuntu2
    • 2:12.0.0-0ubuntu3
    • 2:12.0.1-0ubuntu1
    • 2:12.0.1-0ubuntu1.1
    • 2:12.0.2-0ubuntu1
    • 2:12.0.3-0ubuntu1
    • 2:12.0.5-0ubuntu1
    • 2:12.0.5-0ubuntu4
    • 2:12.0.5-0ubuntu5
    • 2:12.0.6-0ubuntu1
    • 2:12.0.6-0ubuntu2
    • 2:12.0.6-0ubuntu3
    • 2:12.1.0-0ubuntu1
    • 2:12.1.1-0ubuntu1
    • 2:12.1.1-0ubuntu2
    • 2:12.1.1-0ubuntu3
    • 2:12.1.1-0ubuntu4
    • 2:12.1.1-0ubuntu7
    • 2:12.1.1-0ubuntu8
    • 2:12.1.1-0ubuntu8.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neutron Ubuntu:20.04:LTS

    Versions
    • 2:15.0.0-0ubuntu1
    • 2:16.0.0~b1~git2019121613.3e8abb9a8f-0ubuntu1
    • 2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu1
    • 2:16.0.0~b2~git2020020712.d5b33ffc77-0ubuntu3
    • 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu1
    • 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu2
    • 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu3
    • 2:16.0.0~b3~git2020032420.a0e1b5804e-0ubuntu4
    • 2:16.0.0~b3~git2020041013.e74c8f8c88-0ubuntu1
    • 2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu1
    • 2:16.0.0~b3~git2020041516.5f42488a9a-0ubuntu2
    • 2:16.0.0-0ubuntu0.20.04.1
    • 2:16.0.0-0ubuntu0.20.04.2
    • 2:16.1.0-0ubuntu1
    • 2:16.1.0-0ubuntu2
    • 2:16.2.0-0ubuntu1
    • 2:16.2.0-0ubuntu2
    • 2:16.2.0-0ubuntu3
    • 2:16.3.0-0ubuntu3
    • 2:16.3.1-0ubuntu1
    • 2:16.3.1-0ubuntu1.1
    • 2:16.3.2-0ubuntu2
    • 2:16.3.2-0ubuntu3
    • 2:16.4.0-0ubuntu2
    • 2:16.4.0-0ubuntu3
    • 2:16.4.1-0ubuntu2
    • 2:16.4.2-0ubuntu1
    • 2:16.4.2-0ubuntu2
    • 2:16.4.2-0ubuntu3
    • 2:16.4.2-0ubuntu4
    • 2:16.4.2-0ubuntu5
    • 2:16.4.2-0ubuntu6
    • 2:16.4.2-0ubuntu6.1
    • 2:16.4.2-0ubuntu6.2
    • 2:16.4.2-0ubuntu6.3
    • 2:16.4.2-0ubuntu6.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neutron Ubuntu:22.04:LTS

    Versions
    • 2:19.0.0-0ubuntu1
    • 2:19.1.0+git2022030313.b072cbf05f-0ubuntu1
    • 2:20.0.0-0ubuntu1
    • 2:20.0.0-0ubuntu2
    • 2:20.0.0-0ubuntu3
    • 2:20.1.0-0ubuntu2
    • 2:20.2.0-0ubuntu1
    • 2:20.3.0-0ubuntu1
    • 2:20.3.0-0ubuntu1.1
    • 2:20.3.1-0ubuntu1
    • 2:20.4.0-0ubuntu1
    • 2:20.5.0-0ubuntu1
    • 2:20.5.0-0ubuntu2
    • 2:20.5.0-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neutron Ubuntu:24.04:LTS

    Versions
    • 2:23.0.0-0ubuntu1
    • 2:24.0.0~b1+git2024011914.5ce17647-0ubuntu1
    • 2:24.0.0~rc1-0ubuntu2
    • 2:24.0.0-0ubuntu1
    • 2:24.0.0-0ubuntu2
    • 2:24.1.0-0ubuntu1
    • 2:24.1.0-0ubuntu1.1
    • 2:24.1.0-0ubuntu1.2
    • 2:24.2.2-0ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neutron Ubuntu:26.10

    Versions
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0-0ubuntu2
    • 2:29.0.0~b1+git20260818.132.9aaa6fa-0ubuntu1
    • 2:29.0.0~rc1-0ubuntu1
    • 2:29.0.0-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • neutron Ubuntu:26.04:LTS

    Versions
    • 2:27.0.0-0ubuntu1
    • 2:28.0.0~b2+git20260121.28.762694d1bd-0ubuntu1
    • 2:28.0.0~rc1-0ubuntu1
    • 2:28.0.0~rc2-0ubuntu1
    • 2:28.0.0-0ubuntu1
    • 2:28.0.0-0ubuntu1.1
    • 2:28.0.2-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →