DEBIAN-CVE-2026-50266
In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).
DEBIAN-CVE-2026-50266
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-50266
neutron
Source reference: /affected/0/package/name
- Affected versions
- 2:26.0.0-9
Source reference:
/affected/0/versions2:26.0.0-9+deb13u1Source reference:
/affected/0/versions - Fixed versions
- 2:26.0.3-0+deb13u2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
neutron
Source reference: /affected/1/package/name
- Affected versions
- 2:26.0.0-9
Source reference:
/affected/1/versions2:27.0.0-1Source reference:
/affected/1/versions2:27.0.0~rc1-1Source reference:
/affected/1/versions2:27.0.0~rc1-2Source reference:
/affected/1/versions2:27.0.1-1Source reference:
/affected/1/versions2:27.0.1-2Source reference:
/affected/1/versions2:27.0.1-3Source reference:
/affected/1/versions2:27.0.1-4Source reference:
/affected/1/versions2:27.0.1-5Source reference:
/affected/1/versions2:27.0.1-6Source reference:
/affected/1/versions2:28.0.0-1Source reference:
/affected/1/versions2:28.0.0-2Source reference:
/affected/1/versions2:28.0.0-3Source reference:
/affected/1/versions2:28.0.0-4Source reference:
/affected/1/versions2:28.0.0-5Source reference:
/affected/1/versions2:28.0.0-6Source reference:
/affected/1/versions2:28.0.0~rc1-1Source reference:
/affected/1/versions2:28.0.0~rc1-2Source reference:
/affected/1/versions2:28.0.0~rc2-1Source reference:
/affected/1/versions2:28.0.0~rc2-2Source reference:
/affected/1/versions - Fixed versions
- 2:28.0.0-7
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:26.0.3-0+deb13u2"
}
]
}
],
"package": {
"name": "neutron",
"purl": "pkg:deb/debian/neutron?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2:26.0.0-9",
"2:26.0.0-9+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50266.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:28.0.0-7"
}
]
}
],
"package": {
"name": "neutron",
"purl": "pkg:deb/debian/neutron?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2:26.0.0-9",
"2:27.0.0-1",
"2:27.0.0~rc1-1",
"2:27.0.0~rc1-2",
"2:27.0.1-1",
"2:27.0.1-2",
"2:27.0.1-3",
"2:27.0.1-4",
"2:27.0.1-5",
"2:27.0.1-6",
"2:28.0.0-1",
"2:28.0.0-2",
"2:28.0.0-3",
"2:28.0.0-4",
"2:28.0.0-5",
"2:28.0.0-6",
"2:28.0.0~rc1-1",
"2:28.0.0~rc1-2",
"2:28.0.0~rc2-1",
"2:28.0.0~rc2-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50266.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57252 · Revision 1
- Added to Heist Feed
- Publisher date