CVE-2026-55707
Received Received - Intake

Neutron Subnet Onboarding Privilege Escalation

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: MITRE

Description
In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-55707
EUVD
EUVD-2026-53046

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openstack neutron From 14.0.0 (inc) to 26.0.6 (exc)
openstack neutron From 27.0.0 (inc) to 27.0.4 (exc)
openstack neutron From 28.0.0 (inc) to 28.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55707 is a vulnerability in OpenStack Neutron's subnetpool onboarding API. An authenticated user can onboard subnets from another project's shared network into their own subnetpool. This mutates the victim's subnet state and alters L3 routing, NAT, and address-scope behavior for their routers.

Detection Guidance

Check OpenStack Neutron logs for unauthorized subnetpool onboarding API calls. Review subnet associations in shared networks using commands like 'openstack subnet show <subnet-id>' and 'openstack subnetpool list --project <project-id>'. Monitor for unexpected changes in router L3 routing or address scope behavior.

Impact Analysis

This vulnerability allows an attacker to alter routing, NAT, and address-scope behavior for victim routers. It can cause routing issues, disrupt network services, or lead to denial-of-service in deployments using address scopes, DVR, or FIP scope handling.

Mitigation Strategies

Upgrade OpenStack Neutron to a patched version (>=26.0.6, >=27.0.4, or >=28.0.2). Disable the subnetpool onboarding extension if not required. Review and restrict shared network access via RBAC policies. Monitor for suspicious API activity in Neutron logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55707. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart