{"id":"CVE-2026-50266","aliases":["GHSA-qmc5-gv6v-8p22","PYSEC-2026-3491"],"url":"https://o3.security/vulnerability/CVE-2026-50266","summary":"OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks","details":"In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has \"network:\" at the beginning (\"network:dhcp\" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).","published":"2026-06-04T16:18:39.167Z","modified":"2026-08-12T03:51:32.966321783Z","cvss":{"score":2.2,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00262,"percentile":0.17625,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"neutron","fixedVersion":"28.0.1"}],"fix":null,"references":[{"type":"WEB","url":"https://opendev.org/openstack/neutron"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/06/04/6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50266.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50266"},{"type":"REPORT","url":"https://launchpad.net/bugs/2152115"},{"type":"FIX","url":"https://review.opendev.org/990273"},{"type":"FIX","url":"https://review.opendev.org/990353"},{"type":"FIX","url":"https://review.opendev.org/990356"},{"type":"EVIDENCE","url":"https://bugs.launchpad.net/neutron/+bug/2152115"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:32.966321783Z"}}