https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 16:19:51 +0000 https://cve.radiocsirt.org/vuln/cve-2026-50266 <p><strong>Affected:</strong> OpenStack Neutron</p> <p>In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has &#34;network:&#34; at the beginning (&#34;network:dhcp&#34; for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).</p> <p><strong>Affected:</strong> OpenStack Neutron</p> <p>In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has &#34;network:&#34; at the beginning (&#34;network:dhcp&#34; for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).</p> https://cve.radiocsirt.org/vuln/cve-2026-50266 https://cve.radiocsirt.org/vuln/ghsa-qmc5-gv6v-8p22 <p><strong>Affected:</strong> PyPI: neutron</p> <p>In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has &#34;network:&#34; at the beginning (&#34;network:dhcp&#34; for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).</p> <p><strong>Affected:</strong> PyPI: neutron</p> <p>In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has &#34;network:&#34; at the beginning (&#34;network:dhcp&#34; for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).</p> https://cve.radiocsirt.org/vuln/ghsa-qmc5-gv6v-8p22