Is there a patch available for CVE-2026-55707?

Yes, a patch is available for CVE-2026-55707. Update the affected software to the latest version immediately.

OpenStack Neutron CVE-2026-55707

Q: What is the CVSS score of CVE-2026-55707?

CVE-2026-55707 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-53046 HIGH

Incorrect Authorization (CWE-863)

2026-07-29

GHSA-v5q5-3vcq-49r5

Authentication Bypass

7.1

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-accessible API requires low-privilege tenant auth (PR:L); cross-project impact means scope change (S:C); integrity of victim subnets is highly impacted, confidentiality and availability are limited.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 05, 2026 - 06:01 EUVD

Analysis Generated

Jul 29, 2026 - 16:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Cross-project subnet mutation in OpenStack Neutron's subnetpool onboarding feature allows an authenticated tenant to modify subnets belonging to other projects, breaking multi-tenancy isolation. Affected releases span 2025.1/epoxy through the in-development 2026.2/hibiscus branch. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the multi-tenant nature of the affected deployments elevates real-world impact for shared cloud environments.

Technical ContextAI

OpenStack Neutron is the networking-as-a-service component of OpenStack, responsible for managing virtual networks, subnets, and subnet pools across tenant projects. Subnet pools allow projects to allocate subnets from a shared address range. The 'subnetpool onboarding' workflow - which associates existing subnets with a pool - contains an authorization deficiency that permits a project to mutate subnet resources owned by a different project. The root cause class is an improper authorization check (consistent with CWE-284 Improper Access Control or CWE-863 Incorrect Authorization), where the onboarding code path does not enforce project ownership boundaries before applying changes. No CWE was formally assigned in the available advisory data. Patches targeting four release branches (epoxy, flamingo, gazpacho, hibiscus) have been submitted as Gerrit reviews on review.opendev.org.

RemediationAI

Upstream fix is available (PR/commit); released patched version not independently confirmed. Operators should apply the branch-specific Gerrit patches - review.opendev.org/999134 for epoxy, review.opendev.org/999133 for flamingo, review.opendev.org/999132 for gazpacho, and review.opendev.org/999131 for hibiscus - by tracking the merge status and updating from distribution packages once packaged. If immediate patching is not possible, restrict access to the Neutron subnetpool onboarding API endpoint through OpenStack policy.json or oslo.policy rules to limit which roles and projects can invoke onboarding operations; narrowing this to cloud-admin-only trades the self-service convenience of subnetpool onboarding for containment of the cross-project mutation risk. Monitor the OpenStack Security Advisory page at security.openstack.org and the Launchpad bug at bugs.launchpad.net/bugs/2152113 for updated patch availability. No workaround eliminates the flaw without API restriction.