The vulnerability in OpenStack Neutron's subnetpool onboarding API occurs because it does not verify the ownership of target subnets. Authenticated users can exploit this flaw to onboard subnets belonging to other projects' shared networks into their own subnetpool. This unauthorized action can mutate the victim's subnet state and affect L3 routing and address scope behavior, potentially disrupting network operations for the affected tenants. The issue affects versions 14.0.0, 27.0.0, and 28.0.0 of Neutron. The CVSS 4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

An authenticated user can manipulate subnet configurations belonging to other projects, leading to unauthorized changes in subnet states and network routing behavior. This can disrupt network isolation and routing for victim tenants, potentially causing service interruptions or misrouting of traffic within the cloud environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the available data. Until a patch is available, restrict authenticated user privileges and monitor subnetpool onboarding activities closely to detect unauthorized actions.