YAOOK Security Advisory CVE-2026-55707

What is CVE-2026-55707 and how do they affect YAOOK?

Tim Shephard reported that a project member can use PUT /v2.0/subnetpools/{id}/onboard_network_subnets to onboard subnets from another project’s shared network into the caller’s own subnetpool. The API only checks that the supplied network_id is visible to the caller. If the network is RBAC or globally shared, the check passes, and Neutron updates every matching subnet on that network to use the caller-controlled subnetpool. If the caller’s subnetpool is associated with an address scope, the victim router interface is synced with the attacker-controlled address scope.

This lets a shared-network consumer mutate another project’s persistent subnet state and alter L3 routing, NAT, and address-scope behavior for victim routers.

Is my cluster vulnerable?

The following images are vulnerable:
  • neutron images before 1.0.206
  • yaook release before 3.2.0
If this image is used in your cluster for the neutron-api deployment, the cluster is vulnerable.
 
The fixed image has been built in a private pipeline which has been published alongside this advisory to prove the image provenance.

Upgrading

A new stable release will be published according to the release cycle and hotfix releases will be produced starting now. You can upgrade to that release simply by updating your operators.
 
However, we recommend to add a YAOOK_OP_VERSIONS_OVERRIDE variable to your Neutron operator container to pull the image before the YAOOK comprehensive release is ready.
 
The best way to do this is to set the following in the values.yaml of your neutron-operator (make sure to merge this correctly with an existing values.yaml, if you have that).
operator:
    extraEnv:
    - name: YAOOK_OP_VERSIONS_OVERRIDE
    value: |
        {
            "registry.yaook.cloud/yaook/neutron-2023.2": "registry.yaook.cloud/yaook/neutron-2023.2:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2024.1": "registry.yaook.cloud/yaook/neutron-2024.1:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2024.2": "registry.yaook.cloud/yaook/neutron-2024.2:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2025.1": "registry.yaook.cloud/yaook/neutron-2025.1:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2025.2": "registry.yaook.cloud/yaook/neutron-2025.2:1.0.206",
            "registry.yaook.cloud/yaook/neutron-2026.1": "registry.yaook.cloud/yaook/neutron-2026.1:1.0.206"
        }
If you are not using Helm, you can add the environment variable to the env section of your neutron-operator’s Deployment’s pod template.
en_GB
en_GB