{}

{}

{}

{"acknowledgement": "Upstream acknowledges Tim Shephard (roiai.ca) as the original reporter.", "bugzilla": {"description": "openstack-neutron: openstack-neutron: Shared-network consumer can re-scope another project's subnets via subnetpool onboarding", "id": "2507588", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507588"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "status": "draft"}, "cwe": "CWE-863", "details": ["An authorization bypass was found in the OpenStack Neutron subnetpool onboarding API endpoint (PUT /v2.0/subnetpools/{id}/onboard_network_subnets). When a caller supplies a network_id, the API only verifies that the network is visible to the caller but does not verify that the caller owns the subnets on that network. When a network is RBAC-shared or globally shared, any project member with network visibility can invoke the API to onboard another project's subnets into the caller's own subnetpool, mutating the victim's subnet records (setting subnetpool_id to the attacker-controlled pool). If the attacker's subnetpool is associated with an address scope, Neutron syncs the victim's router interfaces with the attacker-controlled address scope, silently altering L3 routing, NAT, and address-scope behavior. The upstream fix adds an ownership check ensuring the caller has admin-or-owner authority over each subnet being onboarded, not merely visibility of the parent network."], "mitigation": {"lang": "en:us", "value": "Restrict the subnetpool onboarding API to administrators only by adding the following to the Neutron policy configuration (policy.yaml):\nonboard_network_subnets: \"role:admin\"\nThis prevents non-admin project members from using the onboard_network_subnets API while maintaining the functionality for cloud administrators. If the subnet onboarding feature is not needed in the deployment, the API can be fully disabled by setting the policy to deny all:\nonboard_network_subnets: \"!\""}, "name": "CVE-2026-55707", "package_state": [{"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "impact": "important", "package_name": "openstack-neutron", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "impact": "important", "package_name": "openstack-neutron", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "impact": "important", "package_name": "openstack-neutron", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-07-29T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55707\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55707\nhttps://launchpad.net/bugs/2152113"], "statement": "Red Hat OpenStack Platform (RHOSP) deployments that ship Neutron with the subnet_onboard API extension enabled are affected by this vulnerability. The vulnerability requires the attacker to be an authenticated project member with access to a shared network containing subnets from other projects, which is a common multi-tenant deployment pattern. Red Hat OpenShift on OpenStack (RHOSO) deployments using Neutron for network management are also potentially affected. The severity is rated as Important because the vulnerability allows authenticated cross-project modification of network state and potential disruption of L3 routing, but does not allow unauthenticated access or code execution.", "threat_severity": "Important"}

{}