CVE-2026-55707 Overview
CVE-2026-55707 is an authorization flaw in OpenStack Neutron before version 28.0.2. The subnetpool onboarding API fails to verify ownership of target subnets before performing the onboarding operation. An authenticated user with a valid project can onboard subnets from another project's shared network into their own subnetpool. This action mutates the victim's subnet state and alters Layer 3 (L3) routing and address scope behavior for victim routers. The weakness is tracked under CWE-863: Incorrect Authorization.
Critical Impact
Any authenticated tenant can manipulate another project's subnets on shared networks, disrupting L3 routing and address scope enforcement for the victim's routers.
Affected Products
- OpenStack Neutron versions prior to 28.0.2
- OpenStack deployments exposing shared networks across projects
- Multi-tenant clouds using subnetpools and address scopes
Discovery Timeline
- 2026-08-05 - CVE-2026-55707 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-55707
Vulnerability Analysis
OpenStack Neutron provides subnetpools as a way for projects to allocate CIDR ranges from a shared pool. The onboarding API accepts an existing subnet and attaches it to a target subnetpool. In vulnerable releases, the API endpoint validates that the caller owns the subnetpool but does not verify that the caller owns the subnet being onboarded. When a network is shared across projects, any authenticated user with visibility of the shared subnet can invoke the onboarding operation against it. The subnet is then bound to the attacker's subnetpool, changing its allocation, prefix relationships, and associated address scope.
Root Cause
The root cause is a missing ownership check on the target subnet inside the subnetpool onboarding handler. The policy enforcement layer confirms rights over the subnetpool resource but omits an equivalent check on the subnet identified in the request payload. This asymmetric authorization is the pattern described by CWE-863, where the code performs an authorization decision that does not correctly reflect the required policy.
Attack Vector
An attacker needs a valid Keystone account and network access to the Neutron API. The attacker identifies a subnet belonging to another project on a shared network. The attacker then issues an onboarding request referencing that subnet against a subnetpool they control. Because the API does not reject cross-project subnet references, the operation completes and the victim's subnet is mutated. This changes address scope membership and can alter L3 routing decisions on routers connected to the victim's subnet.
A proof-of-concept is not publicly available. See the OpenStack Security Advisory OSSA-2026-032 and the Launchpad Bug Report for technical details.
Detection Methods for CVE-2026-55707
Indicators of Compromise
- Neutron API audit entries showing PUT /v2.0/subnetpools/{id}/onboard_network_subnets calls where the requesting project differs from the subnet owner.
- Unexpected changes to subnetpool_id or address_scope_id on subnets belonging to shared networks.
- New subnet allocations in a subnetpool that reference CIDRs owned by other projects.
Detection Strategies
- Enable Neutron API request logging and correlate the project_id of the caller with the project_id of any subnet referenced in onboarding requests.
- Query the Neutron database periodically for subnets whose subnetpool_id maps to a subnetpool in a different project than the subnet's owning project.
- Monitor router state changes and address scope reassignments on shared networks and alert on modifications that were not initiated by the network owner.
Monitoring Recommendations
- Ingest Neutron and Keystone audit logs into a centralized data lake for cross-project authorization analytics.
- Baseline normal subnetpool activity per project and alert on onboarding operations against subnets on shared networks.
- Track routing table and address scope changes in tenant routers and correlate them with Neutron API events.
How to Mitigate CVE-2026-55707
Immediate Actions Required
- Upgrade OpenStack Neutron to version 28.0.2 or later where the ownership check has been added to the onboarding path.
- Audit existing subnetpools for subnets that were onboarded from another project and revert unauthorized associations.
- Restrict use of shared networks to the minimum set of tenants that require cross-project connectivity.
Patch Information
The fix is included in OpenStack Neutron 28.0.2. Refer to the OpenStack Security Advisory OSSA-2026-032 for the list of affected branches, backports, and patch commits. Coordination details are available on the Openwall OSS-Security thread and the Launchpad Bug Report.
Workarounds
- Apply a restrictive policy.yaml rule on the subnetpool onboarding endpoint to require that the calling project matches the subnet owner.
- Avoid sharing networks across untrusted projects until the patch is deployed.
- Set shared=False on networks that do not require cross-tenant use to reduce the attack surface.
# policy.yaml hardening example for Neutron subnetpool onboarding
# Restrict onboarding to administrators until upgrade to 28.0.2 is complete
"onboard_network_subnets": "rule:admin_only"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
