# neutron (PyPI) vulnerabilities 21 known vulnerabilities (1 high, 6 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pypi.org/project/neutron/ ## Advisories (21) ### [CVE-2026-50266](https://cve.now/CVE-2026-50266): In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set… - Severity: Low 2.2 - Published: Jun 4, 2026 - Affected: fixed in 28.0.1. ### [CVE-2026-49299](https://cve.now/CVE-2026-49299): In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the… - Severity: Medium 5.3 - Published: May 28, 2026 - Affected: from 26.0.0, fixed in 26.0.4; from 27.0.0, fixed in 27.0.3; from 28.0.0, fixed in 28.0.1; from 28.0.0, fixed in 28.0.1; from 27.0.0, fixed in 27.0.3; from 26.0.0, fixed in 26.0.4. ### [CVE-2024-53916](https://cve.now/CVE-2024-53916): In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. - Severity: High 7.5 - Published: Nov 24, 2024 - Affected: from 23.0.0, fixed in 23.2.1; from 24.0.0, fixed in 24.0.2; from 25.0.0, fixed in 25.0.1; from 23.0.0, fixed in 23.2.1; from 24.0.0, fixed in 24.0.2; from 25.0.0, fixed in 25.0.1. ### [CVE-2023-3637](https://cve.now/CVE-2023-3637): Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277) - Severity: Medium 4.3 - Published: Jul 25, 2023 - Affected: through 22.0.2. ### [CVE-2022-3277](https://cve.now/CVE-2022-3277): An uncontrolled resource consumption flaw was found in openstack-neutron. - Severity: Medium 6.5 - Published: Mar 6, 2023 - Affected: from 19.0.0.0rc1, fixed in 19.5.0; fixed in 18.6.0; from 20.0.0.0rc1, fixed in 20.3.0; fixed in 18.6.0; from 19.0.0.0rc1, fixed in 19.5.0; from 20.0.0.0rc1, fixed in 20.3.0. ### [CVE-2021-40797](https://cve.now/CVE-2021-40797): An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. - Severity: Unrated - Published: Sep 8, 2021 - Affected: fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1; fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1. ### [CVE-2021-40085](https://cve.now/CVE-2021-40085): An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. - Severity: Unrated - Published: Aug 31, 2021 - Affected: fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1; fixed in 16.4.1; from 17.0.0, fixed in 17.2.1; from 18.0.0, fixed in 18.1.1. ### [CVE-2021-38598](https://cve.now/CVE-2021-38598): OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with… - Severity: Unrated - Published: Aug 23, 2021 - Affected: fixed in 16.4.1; from 17.0.0, fixed in 17.1.3; versions 18.0.0; fixed in 16.4.1; from 17.0.0, fixed in 17.1.3; from 18.0.0, fixed in 18.1.0. ### [CVE-2021-20267](https://cve.now/CVE-2021-20267): A flaw was found in openstack-neutron's default Open vSwitch firewall rules. - Severity: Unrated - Published: May 28, 2021 - Affected: from 16.0.0, fixed in 16.3.1; fixed in 15.3.3; from 17.0.0, fixed in 17.1.1; fixed in 15.3.3; from 16.0.0, fixed in 16.3.1; from 17.0.0, fixed in 17.1.1. ### [CVE-2013-2255](https://cve.now/CVE-2013-2255): HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate… - Severity: Unrated - Published: Nov 1, 2019 - Affected: fixed in 7.0.0a0. ### [CVE-2019-10876](https://cve.now/CVE-2019-10876): An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. - Severity: Unrated - Published: Apr 5, 2019 - Affected: from 12.0.0, fixed in 12.0.6; fixed in 11.0.7; from 13.0.0, fixed in 13.0.3; from 11.0.0, fixed in 11.0.7; from 12.0.0, fixed in 12.0.6; from 13.0.0, fixed in 13.0.3. ### [CVE-2019-9735](https://cve.now/CVE-2019-9735): An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and… - Severity: Unrated - Published: Mar 13, 2019 - Affected: fixed in 10.0.8; from 11.0.0, fixed in 11.0.7; from 12.0.0, fixed in 12.0.6; from 13.0.0, fixed in 13.0.3; from 12.0.0, fixed in 12.0.6; from 13.0.0, fixed in 13.0.3; from 11.0.0, fixed in 11.0.7; fixed in 10.0.8. ### [CVE-2018-14636](https://cve.now/CVE-2018-14636): Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. - Severity: Medium 5.3 - Published: Sep 10, 2018 - Affected: from 13.0.0.0b1, fixed in 13.0.0.0b2; from 12.0.0, fixed in 12.0.3; from 11.0.0, fixed in 11.0.5; from 7.0.0, fixed in 11.0.5; from 12.0.0, fixed in 12.0.3. ### [CVE-2018-14635](https://cve.now/CVE-2018-14635): When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address… - Severity: Medium 6.5 - Published: Sep 10, 2018 - Affected: fixed in 11.0.6; from 12.0.0, fixed in 12.0.4; from 13.0.0.0b1, fixed in 13.0.0.0b2; fixed in 11.0.6; from 12.0.0, fixed in 12.0.4. ### [CVE-2017-7543](https://cve.now/CVE-2017-7543): A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before… - Severity: Medium 5.3 - Published: Jul 26, 2018 - Affected: fixed in 7.2.0-12.1; from 8.0.0, fixed in 8.3.0-11.1; from 9.0.0, fixed in 9.3.1-2.1; from 10.0.0, fixed in 10.0.2-1.1; fixed in 7.2.0-12.1; from 8.0.0, fixed in 8.3.0-11.1; from 9.0.0, fixed in 9.3.1-2.1; from 10.0.0, fixed in 10.0.2-1.1. ### [CVE-2016-5363](https://cve.now/CVE-2016-5363): The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing… - Severity: Unrated - Published: Jun 17, 2016 - Affected: fixed in 7.1.0; from 8.0.0, fixed in 8.1.0; fixed in 7.1.0; from 8.0.0, fixed in 8.1.0. ### [CVE-2016-5362](https://cve.now/CVE-2016-5362): The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended… - Severity: Unrated - Published: Jun 17, 2016 - Affected: fixed in 7.0.5; from 8.0.0, fixed in 8.1.1; fixed in 7.0.5; from 8.0.0, fixed in 8.1.1. ### [CVE-2015-8914](https://cve.now/CVE-2015-8914): The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended… - Severity: Unrated - Published: Jun 17, 2016 - Affected: fixed in 7.0.5; from 8.0.0, fixed in 8.1.1; fixed in 7.0.5; from 8.0.0, fixed in 8.1.1. ### [CVE-2015-5240](https://cve.now/CVE-2015-5240): Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API… - Severity: Unrated - Published: Oct 27, 2015 - Affected: fixed in 7.0.0. ### [CVE-2015-3221](https://cve.now/CVE-2015-3221): OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote… - Severity: Unrated - Published: Aug 26, 2015 - Affected: from 2000, fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.1; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.1. ### [CVE-2014-0056](https://cve.now/CVE-2014-0056): The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote… - Severity: Unrated - Published: May 8, 2014 - Affected: from 2012.2, fixed in 2013.2.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/neutron Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.