In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into their own subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for victim routers.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6444 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6444-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     August 16, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : neutron     CVE ID         : CVE-2026-55707

    Two vulnerabilities were discovered in Neutron, the OpenStack virtual     network service, which could result in incorrect validation of API     permissions.

    For the stable distribution (trixie), this problem has been fixed in     version 2:26.0.3-0+deb13u3.

    We recommend that you upgrade your neutron packages.

    For the detailed security status of neutron please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/neutron

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4735 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4735-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     August 12, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : neutron     Version        : 2:21.0.0-7+deb12u1     CVE ID         : CVE-2026-55707     Debian Bug     : 1142937 1143170

    Multiple vulnerabilities were discovered in Neutron, the OpenStack virtual     network service. These vulnerabilities were reported by Tim Shephard from     roiai.ca.

    CVE-2026-55707

        A project member can onboard subnets from another project's shared network into         their own subnetpool, mutating the victim's persistent subnet state and         altering L3 routing, NAT, and address-scope behavior for victim routers. Only         deployments with shared or RBAC-shared networks and the subnetpool onboarding         extension enabled are affected.

    Not assigned yet

        A project member can read or modify another project's sub-resource by         substituting their own parent resource ID in URL used in APIs. For         conntrack helpers, deletion is also possible. The attack requires         knowing the victim's sub-resource UUID, which is a random UUIDv4 that         cannot be enumerated through the API.

    For Debian 12 bookworm, this problem has been fixed in version     2:21.0.0-7+deb12u1.

    We recommend that you upgrade your neutron packages.

    For the detailed security status of neutron please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/neutron

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target     subnets. An authenticated user can onboard subnets from another project's shared network into their own     subnetpool, mutating the victim's subnet state and altering L3 routing and address scope behavior for     victim routers. (CVE-2026-55707)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335915	Debian dsa-6444 : neutron-api - security update	Nessus	Debian Local Security Checks	Local	high
334973	Debian dla-4735 : neutron-api - security update	Nessus	Debian Local Security Checks	Local	high
331445	Linux Distros Unpatched Vulnerability : CVE-2026-55707	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55707

high

Tenable Plugins

high

high

high