In OpenStack Neutron versions prior to 28.0.1 a project manager can create or modify a port on a shared network owned by another project and set the device_owner field to a value beginning with "network:" (for instance "network:dhcp"). The default port RBAC policies mistakenly included the PROJECT_MANAGER role without checking network ownership, granting the manager the same trusted network-service port privileges on a shared network. This flaw allows the attacker to bypass anti‑spoofing rules and security‑group restrictions, potentially enabling DHCP, MAC, or IP spoofing against tenants using the shared network.

OpenStack Neutron, versions earlier than 28.0.1.

The CVSS score of 2.2 reflects a low base severity, yet the flaw can be leveraged by anyone with project‑manager rights within the OpenStack deployment. Since the attack requires only internal RBAC rights and does not involve remote code execution, the likelihood of exploitation is limited to organizations that expose project‑manager privileges broadly. The vulnerability is not listed in the CISA KEV catalog, and no EPSS information is available. The ability to spoof DHCP or MAC addresses on a shared network could potentially cause denial of service, traffic interception, or privileged escalation within the shared tenant environment; these outcomes are inferred from the described impact and not directly stated in the official description.