CVE-2024-53916 OpenStack Neutron can use an incorrect ID during policy enforcement
An unprivileged tenant can modify tags on network objects belonging to other tenants due to missing policy checks in OpenStack Neutron.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53916?
CVE-2024-53916 is a high-severity missing authorization vulnerability in n/a, published on 24 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.
Weakness: CWE-754
Which versions are affected by CVE-2024-53916?
7 open source packages ship an affected version, including neutron.
| Package | Affected | Fixed in |
|---|---|---|
neutron PyPI | From 23.0.0 | 23.2.1, 24.0.2, 25.0.1 |
neutron PyPI | From 23.0.0 | 23.2.1 |
neutron PyPI | From 23.0.0 | 23.2.1 |
neutron PyPI | From 24.0.0 | 24.0.2 |
neutron PyPI | From 24.0.0 | 24.0.2 |
neutron PyPI | From 25.0.0 | 25.0.1 |
1 more packages
neutron PyPI | From 25.0.0 | 25.0.1 |
How do I fix CVE-2024-53916?
Upgrade neutron to a fixed version for your release line: 23.2.1, 24.0.2 or 25.0.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-53916 being exploited?
There is no known exploitation of CVE-2024-53916 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-53916, GHSA-f27h-g923-68hw, PYSEC-2026-1693, UBUNTU-CVE-2024-53916.