CVE-2026-55707

openstack-neutron: openstack-neutron: Shared-network consumer can re-scope another project's subnets via subnetpool onboarding

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Neutron

CVE-2026-50266

openstack-neutron: OpenStack Neutron: Network spoofing via incorrect port RBAC policies

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Neutron

CVE-2026-49299

openstack-neutron: OpenStack Neutron: Unauthorized tag modification due to policy enforcement mismatch

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags on same-project resources. Deployments running Neutron 26.0.0 or later are affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Neutron

CVE-2024-53916

openstack-neutron: tagging.py can use an incorrect ID during policy enforcement

In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Neutron

CVE-2014-3632

openstack-neutron: regression of fix for CVE-2013-6433

The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat Enterprise Linux 6, allows remote attackers to gain privileges via a crafted configuration file. NOTE: this vulnerability exists because of a CVE-2013-6433 regression.

CVSS 2.0 · 7.6 High EPSS 2.5% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2014-4167

openstack-neutron: L3-agent denial of service through IPv6 subnet

The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address attachment outage) by attaching an IPv6 private subnet to a L3 router.

CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Neutron Openstack

CVE-2014-4615

pycadf: token leak to message queue

The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Neutron Oslo and 3 more

CVE-2014-6414

openstack-neutron: Admin-only network attributes may be reset to defaults by non-privileged users

OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors.

CVSS 2.0 · 4.0 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Neutron Openstack

CVE-2014-7821

openstack-neutron: DoS via maliciously crafted dns_nameservers

OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

CVSS 2.0 · 4.0 Medium EPSS 3.9% KEV · Not listed

Vendors

Fedoraproject Openstack Redhat

Products

Fedora Neutron Openstack

CVE-2014-8153

openstack-neutron: L3 agent denial of service with radvd 2.0+ (OSSA 2015-001)

The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update processing) by creating eight routers and assigning an ipv6 non-provider subnet to each.

CVSS 2.0 · 4.0 Medium EPSS 1.9% KEV · Not listed

Vendors

Litech Openstack

Products

Router Advertisement Daemon Neutron

CVE-2015-3221

openstack-neutron: L2 agent DoS through incorrect allowed address pairs

OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.

CVSS 2.0 · 4.0 Medium EPSS 11.4% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2015-5240

openstack-neutron: Firewall rules bypass through port update

Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.

CVSS 2.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2015-8914

openstack-neutron: ICMPv6 source address spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source address.

CVSS 3.0 · 9.1 Critical EPSS 4.3% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2016-5362

openstack-neutron: DHCP spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.

CVSS 3.0 · 8.2 High EPSS 3.4% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2013-6433

openstack-quantum/openstack-neutron: rootwrap sudo config allows potential privilege escalation

The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file.

CVSS 2.0 · 7.6 High EPSS 3.3% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Neutron Openstack

CVE-2016-5363

openstack-neutron: MAC source address spoofing vulnerability

The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.

CVSS 3.0 · 8.2 High EPSS 3.3% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2014-0056

openstack-neutron: insufficient authorization checks when creating ports

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

CVSS 2.0 · 2.1 Low EPSS 1.4% KEV · Not listed

Vendors

Canonical Openstack Redhat

Products

Ubuntu Linux Neutron Openstack

CVE-2014-0187

openstack-neutron: security groups bypass through invalid CIDR

The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.

CVSS 2.0 · 9.0 Critical EPSS 3.0% KEV · Not listed

Vendors

Canonical Openstack Opensuse and 1 more

Products

Ubuntu Linux Neutron Opensuse and 1 more

CVE-2014-3555

openstack-neutron: Denial of Service in Neutron allowed address pair

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed address pairs.

CVSS 2.0 · 4.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack

CVE-2022-3277

openstack-neutron: unrestricted creation of security groups

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Openstack Redhat

Products

Neutron Openstack Openstack Platform