NE
Product
Neutron
28
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 9Low 1
Watch
Add Neutron to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-38598 | 9.1 | Aug 23 | OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based… Affected: before 16.4.1; 17.0.0 before 17.1.3; 18.0.0 |
| CVE-2015-8914 | 9.1 | Jun 17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently… Affected: 7.0.0 before 7.0.4; 8.0.0 through 8.1.0 |
| CVE-2016-5363 | 8.2 | Jun 17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 8.0.0; +1 more |
| CVE-2016-5362 | 8.2 | Jun 17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently… Affected: 7.0.0 before 7.0.4; 8.0.0 through 8.1.0 |
| CVE-2026-55707 | 7.1 | Aug 5 | In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets Affected: 14.0.0 before 26.0.6; 27.0.0 before 27.0.4; 28.0.0 before 28.0.2 |
| CVE-2021-20267 | 7.1 | May 28 | A flaw was found in openstack-neutron's default Open vSwitch firewall rules Affected: before 16.3.3; 17.0.0 before 17.1.3; 18.0.0 |
| CVE-2022-3277 | 6.5 | Mar 6 | An uncontrolled resource consumption flaw was found in openstack-neutron Affected: before 18.6.0; 19.0.0 before 19.5.0 |
| CVE-2021-40797 | 6.5 | Sep 8 | An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1 Affected: before 16.4.1; 17.0.0 before 17.2.1; 18.0.0 before 18.1.1 |
| CVE-2021-40085 | 6.5 | Aug 31 | An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1 Affected: before 16.4.1; 17.0.0 before 17.2.1; 18.0.0 before 18.1.1 |
| CVE-2019-10876 | 6.5 | Apr 5 | An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 Affected: 11.0.0 before 11.0.7; 12.0.0 before 12.0.6; 13.0.0 before 13.0.3 |
| CVE-2019-9735 | 6.5 | Mar 13 | An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3 Affected: before 10.0.8; 11.0.0 before 11.0.7; 12.0.0 before 12.0.6; 13.0.0 before 13.0.3 |
| CVE-2018-14635 | 6.5 | Sep 10 | When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation Affected: 11.0.0 through 11.0.5; 12.0.0 through 12.0.3; 13.0.0.0 |
| CVE-2017-7543 | 5.9 | Jul 26 | A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor… Affected: 7.0.0 before 7.2.0-12.1; 8.0.0 before 8.3.0-11.1; 9.0.0 before 9.3.1-2.1; 10.0.0 before 10.0.2-1.1 |
| CVE-2026-49299 | 5.3 | May 28 | In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names Affected: 26.0.0 before 26.0.4; 27.0.0 before 27.0.3; 28.0.0 before 28.0.1 |
| CVE-2018-14636 | 5.3 | Sep 10 | Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor Affected: 7.0.0 through 11.0.4; 12.0.0 through 12.0.2; 13.0.0 |
| CVE-2026-50266 | 2.2 | Jun 4 | In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:"… Affected: 25.0.0 before 25.2.4; 26.0.0 before 26.0.4; 27.0.0 before 27.0.3; 28.0.0 before 28.0.1 |
| CVE-2015-5240 | – | Oct 27 | Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to… Affected: 2014.2.3; 2015.1.0; 2015.1.1 |
| CVE-2015-3221 | – | Aug 26 | OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of… Affected: 2014.2 before 2014.2.4; 2015.1.0 before 2015.1.1 |
| CVE-2014-8153 | – | Jan 15 | The L3 agent in OpenStack Neutron 2014.2.x before 2014.2.2, when using radvd 2.0+, allows remote authenticated users to cause a denial of service (blocked router update… Affected: 2014.2; 2014.2.1 |
| CVE-2014-7821 | – | Nov 24 | OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the… Affected: 2012.2.1 before 2014.1.4; 2014.2 before 2014.2.1 |
| CVE-2014-3632 | – | Oct 7 | The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux Open Stack Platform 5.0 for Red Hat… Affected: 2014.1 through 2014.1.2 |
| CVE-2014-6414 | – | Oct 2 | OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors Affected: 2013.2 through 2013.2.4; 2014.1 before 2014.1.2; 2014.2 through 2014.2.4 |
| CVE-2014-4615 | – | Aug 19 | The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno… Affected: 2014.1; 2014.1.1; juno1 |
| CVE-2014-3555 | – | Jul 23 | OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule… Affected: 2013.2.4; 2014.1; 2014.1.1; juno-1 |
| CVE-2014-4167 | – | Jul 11 | The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address… Affected: 2011.1 through 2013.2.3; 2014.1; 2014.1.1 |
| CVE-2013-6433 | – | Jun 2 | The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain… Affected: 2013.1 through 2013.2.3 |
| CVE-2014-0056 | – | May 8 | The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers… Affected: 2012.2; 2012.2.1; 2012.2.2; 2012.2.3; 2012.2.4; 2013.1; +8 more |
| CVE-2014-0187 | – | Apr 28 | The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an… Affected: 2013.1; 2013.1.1; 2013.1.2; 2013.1.3; 2013.1.4; 2013.1.5; +5 more |
Showing 28