OpenStack Neutron

• CVE-2026-55707 High 7.1 In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets from another project's shared network into 0.4%
• CVE-2026-50266 Low 2.2 In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("ne 0.3%
• CVE-2026-49299 Medium 5.3 In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names ev 0.3%