Openstack Neutron
27 CVEs affecting Openstack Neutron. Latest disclosed: 2026-06-04. Critical: 2, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38598 | Critical | 9.1 | 2021-08-23 | OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on… |
CVE-2015-8914 | Critical | 9.1 | 2016-06-17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechan… |
CVE-2016-5363 | High | 8.2 | 2016-06-17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism… |
CVE-2016-5362 | High | 8.2 | 2016-06-17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanis… |
CVE-2021-20267 | High | 7.1 | 2021-05-28 | A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance conne… |
CVE-2022-3277 | Medium | 6.5 | 2023-03-06 | An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for a… |
CVE-2021-40797 | Medium | 6.5 | 2021-09-08 | An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involvi… |
CVE-2021-40085 | Medium | 6.5 | 2021-08-31 | An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a c… |
CVE-2019-10876 | Medium | 6.5 | 2019-04-05 | An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/over… |
CVE-2019-9735 | Medium | 6.5 | 2019-03-13 | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By… |
CVE-2018-14635 | Medium | 6.5 | 2018-09-10 | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address valid… |
CVE-2018-14636 | Medium | 5.3 | 2018-09-10 | Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the… |
CVE-2017-7543 | Medium | 5.3 | 2018-07-26 | A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, fo… |
CVE-2026-50266 | Low | 2.2 | 2026-06-04 | In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value… |
CVE-2026-49299 | | 2026-05-28 | In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules us… | |
CVE-2015-5240 | | 2015-10-27 | Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authen… | |
CVE-2015-3221 | | 2015-08-26 | OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cau… | |
CVE-2014-8153 | | 2015-01-15 | The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked rout… | |
CVE-2014-7821 | | 2014-11-24 | OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameser… | |
CVE-2014-3632 | | 2014-10-07 | The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform… |