CVE-2026-55707

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-24
Weakness: CWE-863

Description

In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

Affected products

OpenStack Neutron: from 14.0.0 before 26.0.6; from 27.0.0 before 27.0.4; from 28.0.0 before 28.0.2 — fixed in 26.0.6, 27.0.4, 28.0.2

How to fix

Upgrade to a fixed version: OpenStack Neutron 26.0.6, 27.0.4, 28.0.2. Check the vendor advisory for mitigations.

References

https://launchpad.net/bugs/2152113
https://security.openstack.org/ossa/OSSA-2026-032.html
https://www.openwall.com/lists/oss-security/2026/07/29/5
http://www.openwall.com/lists/oss-security/2026/07/29/5
https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html

Get alerted when CVE-2026-55707 or the next vulnerability affects your stack