NVD / CVE Program· CNA redhat

CVE-2021-20267: A flaw was found in openstack-neutron's default Open vSwitch firewall rules.

HighCVSS 7.1 · v3.1—No exploit Fix available

Noroxi assessment

Priority: Monitor (action score 28/100)

The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
Probability of exploitation in the next 30 days: 1% (FIRST EPSS); higher than 64.5% of all records.
Anyone who can reach it over the internet can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
Fixed version: neutron (Debian:12) 2:17.1.1-5; neutron (PyPI) 16.3.1, 17.1.1, 15.3.3.
Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).

Low priority for now. Upgrade to neutron (Debian:12) 2:17.1.1-5; neutron (PyPI) 16.3.1, 17.1.1, 15.3.3 or later.

Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it

Primary sources: NVD · CVE.org · FIRST EPSS

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.

Published: May 28, 2021
Updated: Jun 16, 2026
EPSS: 1.0% · 64th percentile
CWE: CWE-345

Report tools

JSON

Action score

Monitor

Low priority for now.

CVSS: 28 / 40 · 7.1 / 10
CISA KEV: 0 / 30 · Not listed
EPSS: 0 / 30 · 1.0%

Get told when this record changes

Not in KEV: no record of exploitation in the wild
No public exploit code on record
A fix has been released

If any of these changes, we'll tell you in the daily email digest.

Is your version affected? Check it

Noroxi analysis

What does it mean in your environment?

The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.

We use this product, ask for help

Affected systems

Is your version affected?

Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.

Vendor	Product	CPE
openstack	neutron	cpe:2.3:a:openstack:neutron
redhat	openstack platform	cpe:2.3:a:redhat:openstack_platform

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

n/a openstack-neutron
- openstack-neutron 15.3.3, openstack-neutron 16.3.1, openstack-neutron 17.1.1affected

Affected versions · NVD (7)

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

openstack neutronbefore 16.3.3
openstack neutron17.0.0 and later · before 17.1.3
openstack neutron18.0.0
redhat openstack platform10.0
redhat openstack platform13.0
redhat openstack platform16.1
redhat openstack platform16.2

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Ecosystem	Package	Affected range	Fix
Debian:12	neutron	before 2:17.1.1-5	2:17.1.1-5
PyPI	neutron	from 16.0.0 · before 16.3.1	16.3.1
PyPI	neutron	from 17.0.0 · before 17.1.1	17.1.1
PyPI	neutron	before 15.3.3	15.3.3

Same product

openstack: all records

Other highest-scoring records for the same primary product.

CVE-2015-8914The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended…
37Monitor
CVE-2014-0187The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to…
37Monitor
CVE-2021-38598OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with…
36Monitor

Published before and after this one in the same product

← EarlierCVE-2019-9735Mar 12, 2019 · An issue was discovered in the iptables firewall module in OpenStack Neutron before 10.0.8, 11.x before 11.0.7, 12.x before 12.0.6, and…
27Monitor
← EarlierCVE-2019-10876Apr 5, 2019 · An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3.
27Monitor
Later →CVE-2021-40085Aug 31, 2021 · An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.
27Monitor

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

Product / package	Fixed version	Source
debian:neutron	2:17.1.1-5 · Debian:12	Package registry (OSV)
PyPI:neutron	15.3.3	Package registry (OSV)
PyPI:neutron	16.3.1	Package registry (OSV)
PyPI:neutron	17.1.1	Package registry (OSV)

Exploit status

No known public exploit

No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.