CVE-2026-50266: OpenStack Neutron Multi-Tenant RBAC Bypass and Network Spoofing

Technical summary

CVE-2026-50266 is a regression in Neutron's port RBAC policy enforcement. The default policies incorrectly permit the PROJECT_MANAGER role to create or update ports on shared networks without validating network ownership. An attacker with project manager privileges can set the device_owner field to values prefixed with "network:" (for example, "network:dhcp"), which designates a port as a trusted network service port. This designation normally applies only to ports created by infrastructure, yet the policy enforcement gap allows cross-project application. On deployments using certain backend drivers, this circumvents anti-spoofing rules (typically enforced via port security or firewall rules) and security group filtering, enabling Layer 2 and Layer 3 spoofing attacks. CWE-863 (Incorrect Authorization) categorizes the underlying flaw.

Business impact

The practical risk depends heavily on deployment architecture. In multi-tenant environments where different projects share network infrastructure, a compromised or malicious project manager account could disrupt other tenants by injecting rogue DHCP responses, flooding with spoofed traffic, or hijacking IP addressing. This erodes tenant isolation guarantees and can violate compliance requirements around workload separation. However, the low CVSS score reflects that exploitation requires high privilege (project manager role) and specific backend configurations; the impact is primarily integrity-focused (traffic manipulation) rather than confidentiality or availability loss. Organizations with strict role-based access controls limiting who holds project manager status will see reduced risk.

Affected systems

OpenStack Neutron versions before 28.0.1 are vulnerable. The affected vendor data was not provided in the source; verify against OpenStack security advisories for the complete list of affected releases and any backported versions for older stable branches. Deployments running Neutron 28.0.1 or later are patched.

Exploitability

Exploitation requires an authenticated account with project manager role privileges, which is a high barrier for external attackers but straightforward for insider threats or compromised admin credentials. The CVSS vector (AC:H, PR:H) reflects this: access is network-based but with high privilege and complex preconditions. Real-world exploitation likelihood is moderate; the attack surface is limited to multi-tenant clouds where projects share networks and attackers have elevated roles. No public exploit code is known, and the vulnerability requires knowledge of OpenStack internals to weaponize effectively.

Remediation

Upgrade Neutron to version 28.0.1 or later. The fix corrects the RBAC policy to enforce network ownership checks before permitting device_owner assignment with "network:" prefixes. Administrators should review and test the patch in a staging environment, particularly if custom RBAC policies have been defined. As an interim mitigation, restrict project manager role assignments to trusted personnel and audit port creation activity on shared networks.

Patch guidance

Apply Neutron 28.0.1 or a newer release. Verify the patch version against the OpenStack security advisory (OSSA-2026-XXX or equivalent) to confirm the fix addresses CVE-2026-50266. Test in a non-production environment to ensure no disruption to existing port configurations or network policies. If running a supported stable branch (e.g., 27.x), verify that a backported patch is available before upgrading to the next major version.

Detection guidance

Monitor Neutron audit logs and API calls for port creation or update operations on shared networks by non-network-owning projects, particularly those setting device_owner to values beginning with "network:". Use OpenStack's port event notifications or Audit middleware to flag cross-project port modifications. Review port configurations via 'openstack port list' and 'openstack port show' to identify any anomalous device_owner assignments. In environments with security monitoring, correlate Neutron API calls with Layer 2 traffic anomalies (unexpected DHCP responses, spoofed MAC addresses) that may indicate exploitation.

Why prioritize this

Although CVSS is LOW, this vulnerability warrants attention because it is a regression of a previously fixed issue (CVE-2015-5240), suggesting a gap in test coverage or review processes. It directly undermines multi-tenant isolation boundaries, a foundational security principle in cloud environments. Organizations with strict isolation requirements or regulatory mandates around workload separation should prioritize patching. Insider threat scenarios and compromised admin accounts elevate practical risk beyond the numerical score.

Risk score, explained

The CVSS 3.1 score of 2.2 (LOW) reflects the requirement for high privilege (project manager role) to trigger the vulnerability and the limited scope of impact (integrity of network traffic, not confidentiality or availability). The complex access conditions (AC:H) and assumption of no user interaction further suppress the score. However, the score does not account for the high business impact in multi-tenant environments where tenant isolation is critical, nor does it capture the reversion of a prior fix—context that security teams should layer into their own risk assessments.

Frequently asked questions