CVE-2026-55707 OpenStack CVE debrief

Who should care

OpenStack Neutron users and administrators, security teams monitoring for potential subnet state mutations, and operators responsible for maintaining and securing OpenStack deployments should be aware of this vulnerability. They should review their OpenStack Neutron versions, monitor for suspicious activity, and ensure that only authorized users have access to the subnetpool onboarding API. Additionally, they should consider implementing compensating controls, such as restricting subnetpool onboarding API access and monitoring for potential subnet state changes.

Technical summary

The subnetpool onboarding API in OpenStack Neutron before version 28.0.2 does not verify ownership of target subnets, allowing authenticated users to onboard subnets from another project's shared network into their own subnetpool. This could potentially alter L3 routing and address scope behavior for victim routers. The vulnerability is due to a lack of proper authorization and validation in the subnetpool onboarding API, which allows an attacker to mutate the victim's subnet state. To exploit this vulnerability, an attacker would need to be an authenticated user with low privileges.

Defensive priority

Authenticated users with low privileges can mutate subnet state, altering L3 routing and address scope behavior for victim routers, indicating a high severity vulnerability.

Recommended defensive actions

• Review and update OpenStack Neutron to version 28.0.2 or later
• Restrict subnetpool onboarding API access to authorized users
• Monitor for suspicious subnet state changes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability exists in OpenStack Neutron before version 28.0.2, where the subnetpool onboarding API does not verify ownership of target subnets, allowing authenticated users to onboard subnets from another project's shared network into their own subnetpool. This could potentially alter L3 routing and address scope behavior for victim routers. To verify, defenders should review the OpenStack Neutron version, check for suspicious subnet state changes, and ensure that only authorized users have access to the subnetpool onboarding API. Additionally, they should monitor for potential subnet state mutations and review compensating controls for exposed systems.

Official resources