OSSA-2026-032: Subnetpool onboarding cross-project subnet mutation¶
- Date:
July 29, 2026
- CVE:
CVE-2026-55707
Affects¶
Neutron: >=14.0.0 <26.0.6, >=27.0.0 <27.0.4, >=28.0.0 <28.0.2
Description¶
Tim Shephard from roiai.ca reported a vulnerability in Neutron’s subnetpool onboarding API. A project member can onboard subnets from another project’s shared network into their own subnetpool, mutating the victim’s persistent subnet state and altering L3 routing, NAT, and address-scope behavior for victim routers. Only deployments with shared or RBAC-shared networks and the subnetpool onboarding extension enabled are affected.
Patches¶
https://review.opendev.org/999134 (2025.1/epoxy)
https://review.opendev.org/999133 (2025.2/flamingo)
https://review.opendev.org/999132 (2026.1/gazpacho)
https://review.opendev.org/999131 (2026.2/hibiscus (development))
Credits¶
Tim Shephard from roiai.ca
