CVE-2026-55707

Name of the Vulnerable Software and Affected Versions OpenStack Neutron versions prior to 28.0.2

Description The subnetpool onboarding API fails to verify the ownership of target subnets. This allows an authenticated user to onboard subnets belonging to another project's shared network into their own subnetpool. Such an action can mutate the subnet state of the victim and alter the L3 routing and address scope behavior for the victim's routers.

Recommendations Update OpenStack Neutron to version 28.0.2 or later.