In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | neutron (PyPI) | 23.0.0 to before 23.2.1 | 23.2.1 | Patch available | GHSA-f27h-g923-68hw |
| — | neutron (PyPI) | 24.0.0 to before 24.0.2 | 24.0.2 | Patch available | GHSA-f27h-g923-68hw |
| — | neutron (PyPI) | 25.0.0 to before 25.0.1 | 25.0.1 | Patch available | GHSA-f27h-g923-68hw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- neutron (PyPI) Vendor— Affected 23.0.0 to before 23.2.1 Fixed in 23.2.1 Patch available GHSA-f27h-g923-68hw
- neutron (PyPI) Vendor— Affected 24.0.0 to before 24.0.2 Fixed in 24.0.2 Patch available GHSA-f27h-g923-68hw
- neutron (PyPI) Vendor— Affected 25.0.0 to before 25.0.1 Fixed in 25.0.1 Patch available GHSA-f27h-g923-68hw
Remediation
- Fix · GHSA-f27h-g923-68hw neutron (PyPI) Fixed in 23.2.1 Advisory →
- Fix · GHSA-f27h-g923-68hw neutron (PyPI) Fixed in 24.0.2 Advisory →
- Fix · GHSA-f27h-g923-68hw neutron (PyPI) Fixed in 25.0.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-53916
- 2026-10-03 Alias added: GHSA-f27h-g923-68hw
References
Other 6
- https://review.opendev.org/c/openstack/neutron/+/935883
- https://review.opendev.org/q/project:openstack/neutron
- https://github.com/openstack/neutron/blob/363ffa6e9e1ab5968f87d45bc2f1cb6394f48b9f/neutron/extensions/tagging.py#L138-L232
- https://security.openstack.org/ossa/OSSA-2024-005.html
- https://github.com/openstack/neutron
- http://www.openwall.com/lists/oss-security/2024/12/03/1
Sources
- CVE-2024-53916 · CVE Program
- CVE-2024-53916 · NVD
- FIRST EPSS
- GHSA-f27h-g923-68hw · GitHub Advisory Database · CC BY 4.0
- CVE-2024-53916 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences