CVE-2026-50266: openstack neutron Incorrect Authorization

Vulnerability summary

CVE-2026-50266 is a low (CVSS 2.2) Incorrect Authorization vulnerability in openstack neutron. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-06-2026
   PublishedVulnerability first disclosed.
2. 04-06-2026
   Last modifiedVulnerability information updated.

Description

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.