{"cve":"CVE-2026-55707","nvd":{"published":"2026-08-05T06:16:37.903","modified":"2026-10-24T16:10:00.153","status":"Deferred","description":"In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":null,"cwes":["CWE-863"],"references":["https://launchpad.net/bugs/2152113","https://security.openstack.org/ossa/OSSA-2026-032.html","https://www.openwall.com/lists/oss-security/2026/07/29/5","http://www.openwall.com/lists/oss-security/2026/07/29/5","https://lists.debian.org/debian-lts-announce/2026/08/msg00024.html"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:34.184483516+00:00"},"epss":{"cve":"CVE-2026-55707","score":0.00427,"percentile":0.36715,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}