CVE-2024-53916

What it actually does

Incorrect ID passed during policy enforcement in neutron/extensions/tagging.py allows modification of network tags without verifying tenant ownership.

Why it matters to the business

Unauthorized changes to network metadata can disrupt cloud operations, cause configuration drift, or enable attackers to hide resources in multi-tenant environments; low exploit likelihood but affects many OpenStack deployments.

How an attack unfolds

An unauthenticated or low-privileged tenant crafts an API request targeting the tagging extension, supplying a network ID that bypasses the ownership check because the wrong identifier is used for authorization.

How to fix it

Upgrade OpenStack Neutron to 23.2.1, 24.0.2, or 25.0.1 (or newer) depending on the release train in use.

How to confirm the fix worked

Confirm the installed Neutron version meets or exceeds the fixed releases, then test that tag modification requests on another tenant's network are rejected by policy.

Typical attack path

1. Discover network IDs via public or leaked API responses
2. Issue PUT/POST requests to the tagging endpoint with a foreign network ID
3. Add or clear tags without triggering policy denial

How to detect it

Search Neutron API logs for tagging extension calls that reference network IDs outside the requesting tenant's ownership.

What your security team should do

• Apply the version-specific upgrades without delay
• Audit Neutron API logs for unexpected tag changes on shared or foreign networks
• Tighten tagging policies if custom rules are in place