QSearchQSearch

CVE-2021-38598

9.1 CRITICAL

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with eb...

Published: 2021-08-23 · Last updated: 2026-06-17

Severity and scoring

CVSS
9.1 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE
CWE-290

Affected products

VendorProduct
openstackneutron

Description

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-50589 — In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API o... (5.3 MEDIUM)
  • CVE-2026-48681 — OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image (5.9 MEDIUM)
  • CVE-2026-44917 — OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via ... (4.9 MEDIUM)
  • CVE-2026-46447 — OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info (5.8 MEDIUM)
  • CVE-2026-44394 — An issue was discovered in OpenStack Keystone before 29.0.2 (6.0 MEDIUM)

Same CWE

  • CVE-2026-53857 — OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowF... (8.1 HIGH)
  • CVE-2026-53849 — OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account i... (8.1 HIGH)
  • CVE-2026-42662 — Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions (6.5 MEDIUM)
  • CVE-2026-27089 — Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions (7.5 HIGH)
  • CVE-2026-36537 — ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange (9.8 CRITICAL)