================================================================== OSSA-2026-032: Subnetpool onboarding cross-project subnet mutation ==================================================================
:Date: July 29, 2026 :CVE: CVE-2026-55707 Affects ~~~~~~~ - Neutron: >=14.0.0 <26.0.6, >=27.0.0 <27.0.4, >=28.0.0 <28.0.2 Description ~~~~~~~~~~~Tim Shephard from roiai.ca reported a vulnerability in Neutron's subnetpool onboarding API. A project member can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's persistent subnet state and altering L3 routing, NAT, and address-scope behavior for victim routers. Only deployments with shared or RBAC-shared networks and the subnetpool onboarding extension enabled are affected.
Patches ~~~~~~~ - https://review.opendev.org/999134 (2025.1/epoxy) - https://review.opendev.org/999133 (2025.2/flamingo) - https://review.opendev.org/999132 (2026.1/gazpacho) - https://review.opendev.org/999131 (2026.2/hibiscus (development)) Credits ~~~~~~~ - Tim Shephard from roiai.ca References ~~~~~~~~~~ - https://launchpad.net/bugs/2152113 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55707 -- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
OpenPGP_0x0638DAD3B82C3988.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ OpenStack-announce mailing list -- [email protected] To unsubscribe send an email to [email protected]
