Neutron (Openstack) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 158 known versions, newest CVE from 2026-08-05. Vendor: Openstack.

CVEs of Neutron

• CVE-2026-55707 - CVSS 7.1 (high), 2026-08-05: In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets…
• CVE-2026-50266 - CVSS 2.2 (low), 2026-06-04: In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value…
• CVE-2026-49299 - CVSS 5.3 (medium), 2026-05-28: In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules…
• CVE-2024-53916 - CVSS 7.5 (high), 2024-11-25: In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check…
• CVE-2022-3277 - CVSS 6.5 (medium), 2023-03-06: An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for…
• CVE-2021-40797 - CVSS 6.5 (medium), 2021-09-08: An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests…
• CVE-2021-40085 - CVSS 6.5 (medium), 2021-08-31: An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a…
• CVE-2021-38598 - CVSS 9.1 (critical), 2021-08-23: OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on…
• CVE-2021-20267 - CVSS 7.1 (high), 2021-05-28: A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance…
• CVE-2019-10876 - CVSS 6.5 (medium), 2019-04-05: An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with…
• CVE-2019-9735 - CVSS 6.5 (medium), 2019-03-13: An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By…
• CVE-2018-14636 - CVSS 5.3 (medium), 2018-09-10: Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if…
• CVE-2018-14635 - CVSS 6.5 (medium), 2018-09-10: When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address…
• CVE-2017-7543 - CVSS 5.9 (medium), 2018-07-26: A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where,…
• CVE-2016-5363 - CVSS 8.2 (high), 2016-06-17: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection…
• CVE-2016-5362 - CVSS 8.2 (high), 2016-06-17: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection…
• CVE-2015-8914 - CVSS 9.1 (critical), 2016-06-17: The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection…
• CVE-2015-5240 - CVSS 3.5 (low), 2015-10-27: Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote…
• CVE-2015-3221 - CVSS 4 (medium), 2015-08-26: OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to…
• CVE-2014-8153 - CVSS 4 (medium), 2015-01-15: The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked…
• CVE-2014-7821 - CVSS 4 (medium), 2014-11-24: OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted…
• CVE-2014-3632 - CVSS 7.6 (high), 2014-10-07: The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack…
• CVE-2014-6414 - CVSS 4 (medium), 2014-10-02: OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via…
• CVE-2014-4615 - CVSS 5 (medium), 2014-08-19: The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before…
• CVE-2014-3555 - CVSS 4 (medium), 2014-07-23: OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or…
• CVE-2014-4167 - CVSS 3.5 (low), 2014-07-11: The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of…
• CVE-2013-6433 - CVSS 7.6 (high), 2014-06-02: The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows…
• CVE-2014-0056 - CVSS 2.1 (low), 2014-05-08: The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug…
• CVE-2014-0187 - CVSS 9 (critical), 2014-04-28: The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security…