PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50266 OpenStack CVE debrief

CVE-2026-50266 is a security vulnerability in OpenStack Neutron that allows a project manager to bypass security group protections and enable spoofing on shared networks. A project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has 'network:' at the beginning, such as 'network:dhcp'. The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. This can lead to DHCP, MAC, or IP spoofing against other tenants on the shared network.

Vendor
OpenStack
Product
Neutron
CVSS
LOW 2.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of OpenStack Neutron, particularly those with shared networks and multiple projects, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has 'network:' at the beginning. The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network.

Defensive priority

Low

Recommended defensive actions

  • Upgrade to OpenStack Neutron version 28.0.1 or later.
  • Review and update the default port RBAC policies to require network ownership.

Evidence notes

This vulnerability is a regression of CVE-2015-5240 (OSSA-2015-018).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50266 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50266

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50266 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50266

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.