Sign in
Deutsch English Español Polski
Medium

OpenStack Neutron Race Condition vulnerability

  • Disclosed: 13.05.2022
  • Updated: 11.10.2026 15:17

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) neutron < 7.2.0-12.1, >= 8.0.0, < 8.3.0-11.1, >= 9.0.0, < 9.3.1-2.1, >= 10.0.0, < 10.0.2-1.1 7.2.0-12.1, 8.3.0-11.1, 9.3.1-2.1, 10.0.2-1.1

References

CVSS score 5.9/10
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE)
CWE-362
Platform
Python (PyPI)
Package
neutron
Disclosed
13.05.2022
Updated
11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-686 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-hvxr-2fvv-c3wq - CC BY 4.0

Vulnerability history: neutron

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
09.2018 06.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 9
  • Medium 9
  • Low 2

Disclosures per year

Severity:
  1. OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
    High · 8.2 CVE-2016-5363 < 7.1.0, >= 8.0.0, < 8.1.0 7.1.0, 8.1.0
  2. OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
    High · 8.2 CVE-2016-5362 < 7.0.5, >= 8.0.0, < 8.1.1 7.0.5, 8.1.1
  3. OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism
    Critical · 9.1 CVE-2015-8914 < 7.0.5, >= 8.0.0, < 8.1.1 7.0.5, 8.1.1
  4. OpenStack Neutron Race Condition vulnerability this entry
    Medium · 5.9 CVE-2017-7543 < 7.2.0-12.1, >= 8.0.0, < 8.3.0-11.1, >= 9.0.0, < 9.3.1-2.1, >= 10.0.0, < 10.0.2-1.1 7.2.0-12.1, 8.3.0-11.1, 9.3.1-2.1, 10.0.2-1.1
  5. An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authentica
    High · 6.5 CVE-2021-40797 < 16.4.1, >= 17.0.0, < 17.2.1, >= 18.0.0, < 18.1.1 16.4.1, 17.2.1, 18.1.1
  6. An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.
    High · 6.5 CVE-2021-40085 < 16.4.1, >= 17.0.0, < 17.2.1, >= 18.0.0, < 18.1.1 16.4.1, 17.2.1, 18.1.1
  7. OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending ca
    High · 9.1 CVE-2021-38598 < 16.4.1, >= 17.0.0, < 17.1.3, >= 18.0.0, < 18.1.0 16.4.1, 17.1.3, 18.1.0
  8. A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonat
    High · 7.1 CVE-2021-20267 < 15.3.3, >= 16.0.0, < 16.3.1, >= 17.0.0, < 17.1.1 15.3.3, 16.3.1, 17.1.1
  9. An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated use
    High · 6.5 CVE-2019-10876 >= 12.0.0, < 12.0.6, < 11.0.7, >= 13.0.0, < 13.0.3 12.0.6, 11.0.7, 13.0.3
  10. An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By setting a destination port in a security
    High · 6.5 CVE-2019-9735 >= 12.0.0, < 12.0.6, >= 13.0.0, < 13.0.3, >= 11.0.0, < 11.0.7, < 10.0.8 12.0.6, 13.0.3, 11.0.7, 10.0.8
  11. When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service coul
    High · 6.5 CVE-2018-14635 < 11.0.6, >= 12.0.0, < 12.0.4 11.0.6, 12.0.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.