CVE-2026-50266
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In OpenStack Neutron before version 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value starting with "network:". Default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240.
Risk Assessment
The organization is exposed to spoofing attacks on shared networks, which can lead to traffic interception and compromise of confidentiality and integrity of other tenants' data.
Recommendation
Immediately update OpenStack Neutron to version 28.0.1 or later, which includes a fix that corrects the RBAC policies.
Original NVD description (English source)
In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).