SB2026061842 - Debian update for neutron

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061842

SB2026061842 - Debian update for neutron

Published: June 18, 2026

Security Bulletin ID SB2026061842
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2026-50266)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass anti-spoofing and security group protections.

The vulnerability exists due to improper access control in Neutron default port RBAC rules when creating or updating a port on a shared network owned by another project. A remote user can set the device_owner field to a trusted network-service value such as network:dhcp to bypass anti-spoofing and security group protections.

Exploitation requires project manager permissions and affects shared networks owned by another project. Depending on backend and deployment, the impact may vary.


Remediation

Install update from vendor's website.

References