TI-2026-37009 Aliases CVE-2026-50266 GHSA-qmc5-gv6v-8p22

Incorrect authorization in OpenStack Neutron

MEDIUM 45CWE-863Published 2026-06-04 · Updated 2026-06-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00262 18th percentileScored 2026-11-07

Fix Partial Neutron (OpenStack): 25.2.4, 26.0.4, 27.0.3 +1neutron (PyPI): 28.0.1Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenStack	Neutron	25.0.0 to before 25.2.4; 26.0.0 to before 26.0.4; 27.0.0 to before 27.0.3; 28.0.0 to before 28.0.1	25.2.4, 26.0.4, 27.0.3, 28.0.1	Patch available	CNA
—	neutron (PyPI)	before 28.0.1	28.0.1	Patch available	GHSA-qmc5-gv6v-8p22

Neutron VendorOpenStack Affected 25.0.0 to before 25.2.4; 26.0.0 to before 26.0.4; 27.0.0 to before 27.0.3; 28.0.0 to before 28.0.1 Fixed in 25.2.4, 26.0.4, 27.0.3, 28.0.1 Patch available CNA
neutron (PyPI) Vendor— Affected before 28.0.1 Fixed in 28.0.1 Patch available GHSA-qmc5-gv6v-8p22

Remediation

Fix · CNA Neutron (OpenStack) Fixed in 25.2.4, 26.0.4, 27.0.3, 28.0.1
Fix · GHSA-qmc5-gv6v-8p22 neutron (PyPI) Fixed in 28.0.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 16.2	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 17.1	Affected	No fix yet: Fix deferred
Red Hat OpenStack Platform 18.0	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-50266
2026-10-03 Alias added: GHSA-qmc5-gv6v-8p22

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-50266

Other 4

TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
TI-2026-63467 Code injection in OpenStack Octavia CVSS 4.0CRITICAL 9.4
TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8

See all 332 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences