The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.

Kashyap Chamarthy <kchamart> reports:

It's possible for Neutron (OpenStack networking) users to pass arbitrary config files via rootwrap[] which allows privilege escalation by letting user add more exec directories, change configurations of commands using rootwrap, log more than what needs to be done, etc.

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.