Technical impact
In OpenStack Neutron versions prior to 28.0.1 a project manager can create or modify a port on a shared network owned by another project and set the device_owner field to a value beginning with "network:" (for instance "network:dhcp"). The default port RBAC policies mistakenly included the PROJECT_MANAGER role without checking network ownership, granting the manager the same trusted network-service port privileges on a shared network. This flaw allows the attacker to bypass anti‑spoofing rules and security‑group restrictions, potentially enabling DHCP, MAC, or IP spoofing against tenants using the shared network.
Affected Systems
OpenStack Neutron, versions earlier than 28.0.1.
Risk and Exploitability
The CVSS score of 2.2 reflects a low base severity, yet the flaw can be leveraged by anyone with project‑manager rights within the OpenStack deployment. Since the attack requires only internal RBAC rights and does not involve remote code execution, the likelihood of exploitation is limited to organizations that expose project‑manager privileges broadly. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score indicates a probability of exploitation of less than 1%. The ability to spoof DHCP or MAC addresses on a shared network could potentially cause denial of service, traffic interception, or privileged escalation within the shared tenant environment; these outcomes are inferred from the described impact and not directly stated in the official description.
Debian DSA
Github GHSA