YAOOK Security Advisory CVE-2026-55707

What is CVE-2026-55707 and how does it affect YAOOK?

Tim Shephard reported that a project member can use PUT /v2.0/subnetpools/{id}/onboard_network_subnets to onboard subnets from another project’s shared network into the caller’s own subnet pool. The API only checks that the supplied network_id is visible to the caller. If the network is RBAC or globally shared, the check passes, and Neutron updates every matching subnet on that network to use the subnet pool controlled by the caller. If the caller’s subnet pool is associated with an address scope, the victim router interface is synchronised with the address scope controlled by the attacker.

This allows a shared-network consumer to modify another project’s persistent subnet state and alter L3 routing, NAT and address-scope behaviour for affected routers.

Is my cluster vulnerable?

The following images are vulnerable:
  • Neutron images prior to version 1.0.206
  • yaook release prior to 3.2.0
If this image is used in your cluster for the neutron-api deployment, the cluster is vulnerable.
 
The fixed image has been built in a private pipeline which has been published alongside this advisory to prove the image provenance.

Upgrading

A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators.
 
However, we recommend adding a YAOOK_OP_VERSIONS_OVERRIDE Add a variable to your Neutron operator container to fetch the image before the YAOOK comprehensive release is ready.
 
The best way to do this is to set the following in the `values.yaml` file of your Neutron operator (make sure to merge this correctly with any existing `values.yaml` file, if you have one).
operator:
    extraEnv:
    - name: YAOOK_OP_VERSIONS_OVERRIDE
    value: |
 {
 "registry.yaook.cloud/yaook/neutron-2023.2": "registry.yaook.cloud/yaook/neutron-2023.2:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2024.1": "registry.yaook.cloud/yaook/neutron-2024.1:1.0.206",
 "registry.yaook.cloud/yaook/neutron-2024.2": "registry.yaook.cloud/yaook/neutron-2024.2:1.0.206",
 "registry.yaook.cloud/yaook/neutron-2025.1": "registry.yaook.cloud/yaook/neutron-2025.1:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2025.2": "registry.yaook.cloud/yaook/neutron-2025.2:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2026.1": "registry.yaook.cloud/yaook/neutron-2026.1:1.0.206"
 }
If you are not using Helm, you can add the environment variable to the env section of your neutron-operator’s Deployment’s pod template.
de_DE_formal
de_DE_formal