In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
OpenStack Neutron unaffected
Version Status Constraints
25.0.0 affected < 25.2.4
26.0.0 affected < 26.0.4
27.0.0 affected < 27.0.3
28.0.0 affected < 28.0.1

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Openstack Subscribe
Neutron Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://launchpad.net/bugs/2152115 cve-icon
https://review.opendev.org/990273 cve-icon
https://review.opendev.org/990353 cve-icon
https://review.opendev.org/990356 cve-icon
https://www.openwall.com/lists/oss-security/2026/06/04/6 cve-icon
History

Thu, 04 Jun 2026 16:45:00 +0000

Type Values Removed Values Added
Description In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).
First Time appeared Openstack
Openstack neutron
Weaknesses CWE-863
CPEs cpe:2.3:a:openstack:neutron:*:*:*:*:*:*:*:*
Vendors & Products Openstack
Openstack neutron
References
Metrics cvssV3_1

{'score': 2.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-04T16:18:39.167Z

Reserved: 2026-06-04T16:18:38.592Z

Link: CVE-2026-50266

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses