{"id":5393,"date":"2026-07-29T16:27:36","date_gmt":"2026-07-29T14:27:36","guid":{"rendered":"https:\/\/yaook.cloud\/?page_id=5393"},"modified":"2026-07-30T10:07:40","modified_gmt":"2026-07-30T08:07:40","slug":"security-advisories-cve-2026-55707","status":"publish","type":"page","link":"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-55707\/","title":{"rendered":"security-advisories\/cve-2026-55707"},"content":{"rendered":"<div data-elementor-type=\"wp-page\" data-elementor-id=\"5393\" class=\"elementor elementor-5393\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-56e0628 e-flex e-con-boxed e-con e-parent\" data-id=\"56e0628\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-050bc69 elementor-widget elementor-widget-text-editor\" data-id=\"050bc69\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h1>YAOOK Security Advisory CVE-2026-55707<\/h1><ul><li>Date: 29 July 2026<\/li><li>Upstream advisory: <a href=\"https:\/\/security.openstack.org\/ossa\/OSSA-2026-032.html\">https:\/\/security.openstack.org\/ossa\/OSSA-2026-032.html<\/a><\/li><li>Upstream bug: <a href=\"https:\/\/launchpad.net\/bugs\/2152113\">https:\/\/launchpad.net\/bugs\/2152113<\/a><\/li><\/ul><h2>What is CVE-2026-55707 and how does it affect YAOOK?<\/h2><p>Tim Shephard reported that a project member can use PUT \/v2.0\/subnetpools\/{id}\/onboard_network_subnets to onboard subnets from another project\u2019s shared network into the caller\u2019s own subnet pool. The API only checks that the supplied network_id is visible to the caller. If the network is RBAC or globally shared, the check passes, and Neutron updates every matching subnet on that network to use the subnet pool controlled by the caller. If the caller\u2019s subnet pool is associated with an address scope, the victim router interface is synchronised with the address scope controlled by the attacker.<\/p><p>This allows a shared-network consumer to modify another project\u2019s persistent subnet state and alter L3 routing, NAT and address-scope behaviour for affected routers.<\/p><h2>Is my cluster vulnerable?<\/h2><div>The following images are vulnerable:<\/div><ul><li>Neutron images prior to version 1.0.206<\/li><li>yaook release prior to 3.2.0<\/li><\/ul><div>If this image is used in your cluster for the neutron-api deployment, the cluster is vulnerable.<\/div><div>\u00a0<\/div><div>The fixed image has been built in a <a href=\"https:\/\/gitlab.com\/yaook-security\/images\/neutron\/-\/pipelines\/2699882611\">private pipeline<\/a> which has been published alongside this advisory to prove the image provenance.<\/div><h2>Upgrading<\/h2><div>A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators.<\/div><div>\u00a0<\/div><div>However, we recommend adding a <a title=\"https:\/\/docs.yaook.cloud\/user\/references\/env-reference.html#envvar-YAOOK_OP_VERSIONS_OVERRIDE\" href=\"https:\/\/docs.yaook.cloud\/user\/references\/env-reference.html#envvar-YAOOK_OP_VERSIONS_OVERRIDE\" target=\"_blank\" rel=\"noopener noreferrer\">YAOOK_OP_VERSIONS_OVERRIDE<\/a> Add a variable to your Neutron operator container to fetch the image before the YAOOK comprehensive release is ready.<\/div><div>\u00a0<\/div><div>The best way to do this is to set the following in the `values.yaml` file of your Neutron operator (make sure to merge this correctly with any existing `values.yaml` file, if you have one).<\/div><pre class=\"rcx-box rcx-box--full rcx-css-1siaxf\" role=\"region\" data-code-block-wrapper=\"true\"><code class=\"code-colors language-yaml hljs\"><span class=\"hljs-attr\">operator:<\/span>\n    <span class=\"hljs-attr\">extraEnv:<\/span>\n    <span class=\"hljs-bullet\">-<\/span> <span class=\"hljs-attr\">name:<\/span> <span class=\"hljs-string\">YAOOK_OP_VERSIONS_OVERRIDE<\/span>\n    <span class=\"hljs-attr\">value:<\/span> <span class=\"hljs-string\">|\n {\n \"registry.yaook.cloud\/yaook\/neutron-2023.2\": \"registry.yaook.cloud\/yaook\/neutron-2023.2:1.0.206\",\n            \"registry.yaook.cloud\/yaook\/neutron-2024.1\": \"registry.yaook.cloud\/yaook\/neutron-2024.1:1.0.206\",\n \"registry.yaook.cloud\/yaook\/neutron-2024.2\": \"registry.yaook.cloud\/yaook\/neutron-2024.2:1.0.206\",\n \"registry.yaook.cloud\/yaook\/neutron-2025.1\": \"registry.yaook.cloud\/yaook\/neutron-2025.1:1.0.206\",\n            \"registry.yaook.cloud\/yaook\/neutron-2025.2\": \"registry.yaook.cloud\/yaook\/neutron-2025.2:1.0.206\",<br \/>            \"registry.yaook.cloud\/yaook\/neutron-2026.1\": \"registry.yaook.cloud\/yaook\/neutron-2026.1:1.0.206\"\n }<\/span><\/code><\/pre><div>If you are not using Helm, you can add the environment variable to the <code class=\"code-colors inline\">env<\/code> section of your neutron-operator\u2019s Deployment\u2019s pod template.<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>YAOOK Security Advisory CVE-2026-55707 Date: 2026-07-29 Upstream advisory: https:\/\/security.openstack.org\/ossa\/OSSA-2026-032.html Upstream bug: https:\/\/launchpad.net\/bugs\/2152113 What is CVE-2026-55707 and how do they affect YAOOK? Tim Shephard reported that a project member can use PUT \/v2.0\/subnetpools\/{id}\/onboard_network_subnets to onboard subnets from another project&#8217;s shared network into the caller&#8217;s own subnetpool. The API only checks that the supplied network_id is visible [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-5393","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>security-advisories\/cve-2026-55707 &#187; Yaook<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-55707\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"security-advisories\/cve-2026-55707 &#187; Yaook\" \/>\n<meta property=\"og:description\" content=\"YAOOK Security Advisory CVE-2026-55707 Date: 2026-07-29 Upstream advisory: https:\/\/security.openstack.org\/ossa\/OSSA-2026-032.html Upstream bug: https:\/\/launchpad.net\/bugs\/2152113 What is CVE-2026-55707 and how do they affect YAOOK? Tim Shephard reported that a project member can use PUT \/v2.0\/subnetpools\/{id}\/onboard_network_subnets to onboard subnets from another project&#8217;s shared network into the caller&#8217;s own subnetpool. The API only checks that the supplied network_id is visible [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-55707\/\" \/>\n<meta property=\"og:site_name\" content=\"Yaook\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-30T08:07:40+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-55707\\\/\",\"url\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-55707\\\/\",\"name\":\"security-advisories\\\/cve-2026-55707 &#187; Yaook\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#website\"},\"datePublished\":\"2026-07-29T14:27:36+00:00\",\"dateModified\":\"2026-07-30T08:07:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-55707\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-55707\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/security-advisories-cve-2026-55707\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\\\/\\\/yaook.cloud\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"security-advisories\\\/cve-2026-55707\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#website\",\"url\":\"https:\\\/\\\/yaook.cloud\\\/\",\"name\":\"Yaook\",\"description\":\"The Lifecycle Management Tool for OpenStack\",\"publisher\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/yaook.cloud\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#organization\",\"name\":\"ALASCA e.V.\",\"alternateName\":\"Alasca - Verband f\u00fcr betriebsf\u00e4hige, offene Cloud-Infrastrukturen e.V.\",\"url\":\"https:\\\/\\\/yaook.cloud\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/alasca.cloud\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/favicon.png\",\"contentUrl\":\"https:\\\/\\\/alasca.cloud\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/favicon.png\",\"width\":512,\"height\":512,\"caption\":\"ALASCA e.V.\"},\"image\":{\"@id\":\"https:\\\/\\\/yaook.cloud\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"security-advisories\/cve-2026-55707 \u00bb Yaook","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-55707\/","og_locale":"en_GB","og_type":"article","og_title":"security-advisories\/cve-2026-55707 &#187; Yaook","og_description":"YAOOK Security Advisory CVE-2026-55707 Date: 2026-07-29 Upstream advisory: https:\/\/security.openstack.org\/ossa\/OSSA-2026-032.html Upstream bug: https:\/\/launchpad.net\/bugs\/2152113 What is CVE-2026-55707 and how do they affect YAOOK? Tim Shephard reported that a project member can use PUT \/v2.0\/subnetpools\/{id}\/onboard_network_subnets to onboard subnets from another project&#8217;s shared network into the caller&#8217;s own subnetpool. The API only checks that the supplied network_id is visible [&hellip;]","og_url":"https:\/\/yaook.cloud\/en\/security-advisories-cve-2026-55707\/","og_site_name":"Yaook","article_modified_time":"2026-07-30T08:07:40+00:00","twitter_card":"summary_large_image","twitter_misc":{"Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/yaook.cloud\/security-advisories-cve-2026-55707\/","url":"https:\/\/yaook.cloud\/security-advisories-cve-2026-55707\/","name":"security-advisories\/cve-2026-55707 \u00bb Yaook","isPartOf":{"@id":"https:\/\/yaook.cloud\/#website"},"datePublished":"2026-07-29T14:27:36+00:00","dateModified":"2026-07-30T08:07:40+00:00","breadcrumb":{"@id":"https:\/\/yaook.cloud\/security-advisories-cve-2026-55707\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/yaook.cloud\/security-advisories-cve-2026-55707\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/yaook.cloud\/security-advisories-cve-2026-55707\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/yaook.cloud\/"},{"@type":"ListItem","position":2,"name":"security-advisories\/cve-2026-55707"}]},{"@type":"WebSite","@id":"https:\/\/yaook.cloud\/#website","url":"https:\/\/yaook.cloud\/","name":"Yaook","description":"The Lifecycle Management Tool for OpenStack","publisher":{"@id":"https:\/\/yaook.cloud\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/yaook.cloud\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/yaook.cloud\/#organization","name":"ALASCA e.V.","alternateName":"Alasca - Verband f\u00fcr betriebsf\u00e4hige, offene Cloud-Infrastrukturen e.V.","url":"https:\/\/yaook.cloud\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/yaook.cloud\/#\/schema\/logo\/image\/","url":"https:\/\/alasca.cloud\/wp-content\/uploads\/2022\/08\/favicon.png","contentUrl":"https:\/\/alasca.cloud\/wp-content\/uploads\/2022\/08\/favicon.png","width":512,"height":512,"caption":"ALASCA e.V."},"image":{"@id":"https:\/\/yaook.cloud\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages\/5393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/comments?post=5393"}],"version-history":[{"count":19,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages\/5393\/revisions"}],"predecessor-version":[{"id":5417,"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/pages\/5393\/revisions\/5417"}],"wp:attachment":[{"href":"https:\/\/yaook.cloud\/en\/wp-json\/wp\/v2\/media?parent=5393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}