Manage Rules part of the GUI hides the rules currently visible in the Launch Instance modal window. It allows a malicious admin to add backdoor access rules that might be later added to VMs without the knowledge of owner of those VMs. When sending GET request as below, it responds only with the rules that are created by user and this happens when using Manage Rules part of the GUI: On the other hand when using GET request as below, it responds with all SG and it includes all rules, and there is no filtering and this is used in Launch Instance modal window: Here is example of rules display in Manage Rules part of GUI: > /opt/stack/horizon/openstack_dashboard/dashboards/project/security_groups/views.py(50)_get_data() -> return api.neutron.security_group_get(self.request, sg_id) (Pdb) l 45 @memoized.memoized_method 46 def _get_data(self): 47 sg_id = filters.get_int_or_uuid(self.kwargs['security_group_id']) 48 try: 49 from remote_pdb import RemotePdb; RemotePdb('127.0.0.1', 444).set_trace() 50 -> return api.neutron.security_group_get(self.request, sg_id) 51 except Exception: 52 redirect = reverse('horizon:project:security_groups:index') 53 exceptions.handle(self.request, 54 _('Unable to retrieve security group.'), 55 redirect=redirect) (Pdb) p api.neutron.security_group_get(self.request, sg_id) , , , ]}> (Pdb) (Pdb) p self.request As you might have noticed there are no ports access 44 and 22 (SSH) And from the Launch Instance Modal Window, as well as CLI we can see that there are two more rules that are invisible for user, port 44 and 22 (SSH) as displayed below: > /opt/stack/horizon/openstack_dashboard/api/rest/network.py(47)get() -> return {'items': [sg.to_dict() for sg in security_groups]} (Pdb) l 42 """ 43 44 security_groups = api.neutron.security_group_list(request) 45 from remote_pdb import RemotePdb; RemotePdb('127.0.0.1', 444).set_trace() 46 47 -> return {'items': [sg.to_dict() for sg in security_groups]} 48 49 50 @urls.register 51 class FloatingIP(generic.View): 52 """API for a single floating IP address.""" (Pdb) p security_groups [, , , , , ]}>] (Pdb) (Pdb) p request Thank you, Robin