Description
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.
Published: 2026-10-12
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via Authentication Bypass
Action: Patch or Restrict
AI Analysis

Impact

The vulnerability resides in the basic authentication handling of the OpenStack Network Exporter. When operators enable user authentication but fail to configure Transport Layer Security or leave TLS settings incorrect, the exporter silently ignores the authentication requirement. This fail‑open behavior allows an attacker on an adjacent network to retrieve sensitive metrics—bridge names, port counters, Open vSwitch and Open Virtual Network controller state, and host topology—without providing any credentials.

Affected Systems

Red Hat OpenStack Platform 18.0, specifically the openstack‑network‑exporter component. The exposed metrics are retrieved from Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane services.

Risk and Exploitability

The CVSS score of 7.4 indicates a high severity vulnerability. Although no EPSS value is available, the exploit is straightforward for attackers who can reach TCP port 1981 and have not enforced TLS. The vulnerability is not listed in CISA KEV, but its impact—information disclosure without authentication—demonstrates that the risk is non‑negligible, especially for environments with exposed network interfaces or inadequate firewall controls.

Generated by OpenCVE AI on October 12, 2026 at 20:40 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict access to the `openstack-network-exporter` metrics endpoint (TCP port 1981) to trusted networks or localhost. This can be achieved by configuring firewall rules to block external access to port 1981 or by explicitly setting the `HttpListen` configuration to `127.0.0.1:1981` to bind only to the localhost interface. If the `HttpListen` configuration is changed, the `openstack-network-exporter` service may require a restart or reload for the changes to take effect.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch when it becomes available to address the authentication bypass bug.
  • Restrict access to the metrics endpoint by configuring firewall rules to allow only trusted networks or localhost access.
  • Configure the HttpListen setting to bind the exporter to 127.0.0.1:1981 so that it accepts connections only from the local host and requires a restart or reload after changing this setting.
  • Enable and properly configure Transport Layer Security for the exporter to ensure authentication cannot be circumvented by misconfiguration.

Generated by OpenCVE AI on October 12, 2026 at 20:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openstack Platform
Vendors & Products Redhat openstack Platform

Tue, 13 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 12 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.
Title Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison
First Time appeared Redhat
Redhat openstack
Weaknesses CWE-208
CPEs cpe:/a:redhat:openstack:18.0
Vendors & Products Redhat
Redhat openstack
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Redhat Openstack Openstack Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-13T16:09:30.111Z

Reserved: 2026-08-31T16:53:08.479Z

Link: CVE-2026-83535

cve-icon Vulnrichment

Updated: 2026-10-13T16:09:25.799Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T19:16:39.850

Modified: 2026-10-15T16:33:26.290

Link: CVE-2026-83535

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-12T18:30:36Z

Links: CVE-2026-83535 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T22:50:44Z

Weaknesses
  • CWE-208

    Observable Timing Discrepancy