CVE-2026-55707

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55707", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-06-17T01:24:38.456Z", "datePublished": "2026-08-05T04:44:16.572Z", "dateUpdated": "2026-08-12T19:23:45.731Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Neutron", "repo": "https://opendev.org/openstack/neutron", "vendor": "OpenStack", "versions": [{"lessThan": "26.0.6", "status": "affected", "version": "14.0.0", "versionType": "semver"}, {"lessThan": "27.0.4", "status": "affected", "version": "27.0.0", "versionType": "semver"}, {"lessThan": "28.0.2", "status": "affected", "version": "28.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T04:44:16.572Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://launchpad.net/bugs/2152113"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-032.html"}, {"tags": ["vendor-advisory", "mailing-list"], "url": "https://www.openwall.com/lists/oss-security/2026/07/29/5"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0.0", "versionEndExcluding": "26.0.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*", "versionStartIncluding": "27.0.0", "versionEndExcluding": "27.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*", "versionStartIncluding": "28.0.0", "versionEndExcluding": "28.0.2"}]}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/29/5"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-12T19:23:45.731Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T13:00:38.952377Z", "id": "CVE-2026-55707", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:00:54.698Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/29/5"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-12T19:23:45.731Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55707", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:00:38.952377Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:00:50.959Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/neutron", "vendor": "OpenStack", "product": "Neutron", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "26.0.6", "versionType": "semver"}, {"status": "affected", "version": "27.0.0", "lessThan": "27.0.4", "versionType": "semver"}, {"status": "affected", "version": "28.0.0", "lessThan": "28.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://launchpad.net/bugs/2152113", "tags": ["issue-tracking"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-032.html", "tags": ["vendor-advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/07/29/5", "tags": ["vendor-advisory", "mailing-list"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.0.6", "versionStartIncluding": "14.0.0"}, {"criteria": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.0.4", "versionStartIncluding": "27.0.0"}, {"criteria": "cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.0.2", "versionStartIncluding": "28.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-05T04:44:16.572Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55707", "state": "PUBLISHED", "dateUpdated": "2026-08-12T19:23:45.731Z", "dateReserved": "2026-06-17T01:24:38.456Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-05T04:44:16.572Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Neutron", "repo": "https://opendev.org/openstack/neutron", "vendor": "OpenStack", "versions": [{"lessThan": "26.0.6", "status": "affected", "version": "14.0.0", "versionType": "semver"}, {"lessThan": "27.0.4", "status": "affected", "version": "27.0.0", "versionType": "semver"}, {"lessThan": "28.0.2", "status": "affected", "version": "28.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers."}, {"lang": "es", "value": "En OpenStack Neutron antes de 28.0.2, la API de incorporaci\u00f3n de subnetpool no verifica la propiedad de las subredes objetivo. Un usuario autenticado puede incorporar subredes de la red compartida de otro proyecto a su propio subnetpool, mutando el estado de la subred de la v\u00edctima y alterando el enrutamiento L3 y el comportamiento del \u00e1mbito de direcciones para los routers de la v\u00edctima."}], "id": "CVE-2026-55707", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55707", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T13:00:38.952377Z", "version": "2.0.3"}}]}, "published": "2026-08-05T06:16:37.903", "references": [{"source": "cve@mitre.org", "url": "https://launchpad.net/bugs/2152113"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-032.html"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/07/29/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/29/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"acknowledgement": "Upstream acknowledges Tim Shephard (roiai.ca) as the original reporter.", "bugzilla": {"description": "openstack-neutron: openstack-neutron: Shared-network consumer can re-scope another project's subnets via subnetpool onboarding", "id": "2507588", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507588"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "status": "draft"}, "cwe": "CWE-863", "details": ["An authorization bypass was found in the OpenStack Neutron subnetpool onboarding API endpoint (PUT /v2.0/subnetpools/{id}/onboard_network_subnets). When a caller supplies a network_id, the API only verifies that the network is visible to the caller but does not verify that the caller owns the subnets on that network. When a network is RBAC-shared or globally shared, any project member with network visibility can invoke the API to onboard another project's subnets into the caller's own subnetpool, mutating the victim's subnet records (setting subnetpool_id to the attacker-controlled pool). If the attacker's subnetpool is associated with an address scope, Neutron syncs the victim's router interfaces with the attacker-controlled address scope, silently altering L3 routing, NAT, and address-scope behavior. The upstream fix adds an ownership check ensuring the caller has admin-or-owner authority over each subnet being onboarded, not merely visibility of the parent network."], "mitigation": {"lang": "en:us", "value": "Restrict the subnetpool onboarding API to administrators only by adding the following to the Neutron policy configuration (policy.yaml):\nonboard_network_subnets: \"role:admin\"\nThis prevents non-admin project members from using the onboard_network_subnets API while maintaining the functionality for cloud administrators. If the subnet onboarding feature is not needed in the deployment, the API can be fully disabled by setting the policy to deny all:\nonboard_network_subnets: \"!\""}, "name": "CVE-2026-55707", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "impact": "important", "package_name": "openstack-neutron", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "impact": "important", "package_name": "openstack-neutron", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "impact": "important", "package_name": "openstack-neutron", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-29T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55707\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55707\nhttps://launchpad.net/bugs/2152113"], "statement": "Red Hat OpenStack Platform (RHOSP) deployments that ship Neutron with the subnet_onboard API extension enabled are affected by this vulnerability. The vulnerability requires the attacker to be an authenticated project member with access to a shared network containing subnets from other projects, which is a common multi-tenant deployment pattern. Red Hat OpenShift on OpenStack (RHOSO) deployments using Neutron for network management are also potentially affected. The severity is rated as Important because the vulnerability allows authenticated cross-project modification of network state and potential disruption of L3 routing, but does not allow unauthenticated access or code execution.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "neutron", "vendor": "openstack"}], "created": "2026-07-30T02:00:10.535314+00:00", "updated": "2026-08-05T07:00:10.224021+00:00", "vendors": ["openstack", "openstack$PRODUCT$neutron"]}