- Package:
- src:neutron
- Source:
- src:neutron
- Submitter:
- Thomas Goirand
- Date:
- 2026-08-18 21:49:02 UTC
- Severity:
- normal
- Tags:
As per upstream announce: https://wiki.openstack.org/wiki/OSSN/OSSN-0102 Neutron sub-resource APIs do not verify parent ownership Summary: Several Neutron APIs that operate on sub-resources (port forwardings under floating IPs, conntrack helpers under routers) authorize the request using the parent resource ID from the URL but load the child resource by its own ID without verifying it belongs to that parent. A project member can read or modify another project's sub-resource by substituting their own parent resource ID in the URL. For conntrack helpers, deletion is also possible. The attack requires knowing the victim's sub-resource UUID, which is a random UUIDv4 that cannot be enumerated through the API. Affected Services / Software: neutron: >=13.0.0 <26.0.4, >=27.0.0 <27.0.3, ==28.0.0 Discussion: The affected endpoints follow this pattern: GET/PUT /floatingips/{fip_id}/port_forwardings/{pf_id} (DELETE is not affected; it already validates the parent) GET/PUT/DELETE /routers/{router_id}/conntrack_helpers/{ct_id} Policy checks authorize against the parent (floating IP or router) from the URL. The plugin then loads the child by bare UUID without checking that the child's parent matches the URL parent. This allows a caller who owns one floating IP or router to operate on port forwardings or conntrack helpers belonging to a different project's floating IP or router. The mitigating factor is that the victim's sub-resource UUID cannot be discovered through the API. The list endpoints are scoped to the caller's own parent resources. An attacker would need to obtain the UUID through other means. Recommended Actions: Upgrade Neutron to a version containing the fixes. Patches: The following reviews contain the fixes: Port Forwarding (LP#2150121) 2026.2/hibiscus (development): https://review.opendev.org/989624 2026.1/gazpacho: https://review.opendev.org/990125 2025.2/flamingo: https://review.opendev.org/990126 2025.1/epoxy: https://review.opendev.org/990127 Conntrack Helpers (LP#2152109) 2026.2/hibiscus (development): https://review.opendev.org/991586 2026.1/gazpacho: https://review.opendev.org/991776 2025.2/flamingo: https://review.opendev.org/991777 2025.1/epoxy: https://review.opendev.org/991778 Credits Tim Shephard, roiai.ca Contacts / References Authors: Goutham Pacha Ravi, Red Hat This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0102 Original Launchpad bugs: https://bugs.launchpad.net/neutron/+bug/2150121 https://bugs.launchpad.net/neutron/+bug/2152109 Mailing List : [security-sig] tag on openstack-discuss@lists.openstack.org OpenStack Security : https://security.openstack.org/ CVE: none
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/df1a74bc36b0e5645d247834de12efae61b61448 (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/232e92afb34fddc678bc382c552de07a1078be51 ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/72bdb45ad16bd53f030715c3b45a753cef791428 ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/b15333290d22655b8c5dd648d8c7779cd87a3f68 ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/d4f11b6aa6a09afb55b415f26599f2e01292a4f5 ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/8be5540e2ccb53f5464e1ad476db17c93552b0f3 ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/ddee2d1d938cd2f8caf2386ca3d2cc894f89a443 ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
Hello, Bug #1142937 in neutron reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/openstack-team/services/neutron/-/commit/21d666e878cf90bd01fe46234696ff8716a61d4f ------------------------------------------------------------------------ * OSSN-0102: sub-resource APIs do not verify parent ownership. Applied upstream patches (Closes: #1142937): - "Fix PF GET/PUT parent floating IP validation". - "Fix cross-project access to router conntrack helpers" ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1142937
We believe that the bug you reported is fixed in the latest version of
neutron, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142937@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated neutron package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 22 Jul 2026 23:12:34 +0200
Source: neutron
Architecture: source
Version: 2:28.0.1-2
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1142937 1143170
Changes:
neutron (2:28.0.1-2) unstable; urgency=medium
.
* CVE-2026-55707: subnetpool onboarding cross-project subnet mutation.
Applied upstream fix: CVE-2026-55707-stable-2026.1.patch.
(Closes: #1143170).
* Note: version already addresses OSSN-0102 (Closes: #1142937).
Checksums-Sha1:
b9cb860a9a5ece8f58fd349d878b3cacd97d55ff 4929 neutron_28.0.1-2.dsc
dc20d463785b33d7d2d5416e03d37fc50934ff4e 51652 neutron_28.0.1-2.debian.tar.xz
fea26a4b2614dda7871b200029734cc007df9e1a 22389 neutron_28.0.1-2_amd64.buildinfo
Checksums-Sha256:
9cd2ec6508aa55590640987f50a701de0aed4dd0f8e375f61837a33b854d1df4 4929 neutron_28.0.1-2.dsc
f64209914ca201f6610be60a7c4fe98003c559e2abbae0535b66308a01179b42 51652 neutron_28.0.1-2.debian.tar.xz
ef1b07bc37f43d5948c02d1ba9e4b857858394efcb5184a55f781cc54e4b8e14 22389 neutron_28.0.1-2_amd64.buildinfo
Files:
554926cfae32b6d4f1ac622b741489a7 4929 net optional neutron_28.0.1-2.dsc
436de02286d445f9c902dc2643720afb 51652 net optional neutron_28.0.1-2.debian.tar.xz
ad164a13d73aa7d0d784e3ed13539563 22389 net optional neutron_28.0.1-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmpsTw4ACgkQ1BatFaxr
Q/5s2g/+Kv2NIARnQXPTZ+MunZXZ3gBZU3b90X6pzP7BQxPUpH5OpbtWVMKjTe81
j/6wfh7Zo+XqTU3meViPbfvarTlMVkZfAjdGZjd2ulsZR8Zq+EeSlGABOqRaZmi8
E1n5twonh+coJ5qMf3LoW+d412o/+JkMar3k2gpTo9/N0XGXCMNhTrSR2b7wWWr0
t4EHhs+cda3Vp1UTRgEhaavhaE/sTQRSqSmeqfxj1MpCqACE1Cc0V9l+nBzr1CZ7
Pgu+Q+ZfDgtyKjyp5yFVCix83U8EyQbEUR+KgQp6BkaKXG9lgqH/M53xj5jKvkza
zT9F0TgXhZFkzoFShcQegeQkgEDsXOIiD5x2xzDDzedM3hVdHwme6CEYROjqCiHA
RY8Q65FpI/aGyHYixXaQf9+zbByLbSqN/3mmfEWpc0CDSg3+w9ktRgNWWTQKLMkl
cV23E+wzNZilHp/QAS1Eg81MCFF5/QvcXAveJ9fuCEO5Nj0j4+1y187bhgmtApq7
Dt95izFWkgiJG9E20VQeC3JHlx1rMljx6bJ3ZY60GsMT0ijpUHwEe+VAK8fMre0D
a+raYR6a17OwV1VpAnkmXQt0CR5Gg48D4huyYZlZkWkV+JxE/olrO2Uu9tSU7Cdl
B652DR/xgIJQ8i5HLz0fXSYbdIYTbYm2I41cmTJWwuROyWrfDgc=
=2EZf
-----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of
neutron, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142937@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <zigo@debian.org> (supplier of updated neutron package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 03 Aug 2026 09:47:00 +0200
Source: neutron
Architecture: source
Version: 2:26.0.3-0+deb13u3
Distribution: trixie-security
Urgency: medium
Maintainer: Debian OpenStack <team+openstack@tracker.debian.org>
Changed-By: Thomas Goirand <zigo@debian.org>
Closes: 1142937 1143170
Changes:
neutron (2:26.0.3-0+deb13u3) trixie-security; urgency=medium
.
* CVE-2026-55707: subnetpool onboarding cross-project subnet mutation.
Applied upstream fix: CVE-2026-55707-stable-2025.1.patch.
(Closes: #1143170).
* OSSN-0102: sub-resource APIs do not verify parent ownership. Applied
upstream patches (Closes: #1142937):
- "Fix PF GET/PUT parent floating IP validation".
- "Fix cross-project access to router conntrack helpers"
Checksums-Sha1:
2d67b747dd22de74daafbaa0110ef72823b30a26 5086 neutron_26.0.3-0+deb13u3.dsc
153a29dc30b55187ea6bb052e94cb48d012dc500 10241136 neutron_26.0.3.orig.tar.xz
db5a3ddd1005b90ceea8409f67b12d77a1ff95a1 51024 neutron_26.0.3-0+deb13u3.debian.tar.xz
c5a1a5701c24e48fe685cdba207ed3aa3cc8c052 23276 neutron_26.0.3-0+deb13u3_amd64.buildinfo
Checksums-Sha256:
245caa7ab2dc69a3ae51839307682c1e86766c7021dbf37a6cddf7dfdfb81bc8 5086 neutron_26.0.3-0+deb13u3.dsc
611e8b2e2aab1f6585bd426bcb91b94c3f88215d2913aa1158f6a604d448c1be 10241136 neutron_26.0.3.orig.tar.xz
214fcd5c30a791ef72170e06ce306528b165708de5c397ef94bc326d71851399 51024 neutron_26.0.3-0+deb13u3.debian.tar.xz
a202d21e8df4a39566b9a21c6d86e141061c82a543d09c360b59eda6d6f8af12 23276 neutron_26.0.3-0+deb13u3_amd64.buildinfo
Files:
f5dcebeee8b982d0eb023a6ccef124cb 5086 net optional neutron_26.0.3-0+deb13u3.dsc
605a4f7f503a30e367b766d6a903f853 10241136 net optional neutron_26.0.3.orig.tar.xz
b6ef864b86ef5319db7f7e872256c7c2 51024 net optional neutron_26.0.3-0+deb13u3.debian.tar.xz
e2a7b774dbb7492e9210a193275efe71 23276 net optional neutron_26.0.3-0+deb13u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmp65/IACgkQ1BatFaxr
Q/6s/BAAnvbo95qhu2o8210rJAd3EGecAfduUyPIjrAllqTb4HLKEo2OCw0FBzVL
i8DkqlRdxCPb3VtldS+IK5iPCaDWv1o/UhOCVU6eh5LUbt5id/37N060mZzuaxUF
QGkcN9kdw0lb+jXa+W7u/AY2XJTSxhzc0TBYDbj/KJrYk7j53XplHcg6N+I9Nxdk
1mz4BxvX3glUJYsSHmQOVzg5mXydS6z8O0cv6PUOWCpCBn21VGIOXRpjnXvdVmE2
dOz1a6IX0fvbQGuTwMQHAhlVbppr6RsiUaoial6vsyyJuUA0Sz7gOUiK4rUYXsS1
CxRWCf5aiUmsPttosa6aeV9rMWJjgyu0dRux7G1kadwWpzSEENnm3uVA6OWFOBVT
xQl4+IpcsAIAeMBOFgeDK60OeZYWprjRn4a2RUf9wzKjJt8v028pL9c2GNgHXjnT
XsDZr2oqUj9QSerdNVaUkB5sogcpU/RTAipHcTDHWiUnS70Y8l0zG7EfpXLqpMYR
rYXn1CCSDKy6REnZ6+b6ruTKfUhMflf9Vpgd8yLhKeY8T0pTFnl/hekJ5Ycp+lYf
BHjZaRHP6+MRo+WDIZHVfwn/+YQc2XUou0scg7FMFq6nxT3uAKXusuWgrkvf/Ios
cSUFLLlaWBHls32AE73UBkJf9JfmTkQknetHy3r+SdF1EEDwwj0=
=mLX3
-----END PGP SIGNATURE-----