openstack-network-exporter: Authentication bypass when TLS is misconfigured
Summary
openstack-network-exporter in Red Hat OpenStack Platform 18.0 silently skips basic authentication when user authentication is configured but TLS is omitted or misconfigured. An adjacent network attacker can then read Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials, including bridge names, port counters, OVN controller state and host topology. Red Hat rates the impact as Moderate because the access is read-only; a fixed version is not yet known.
Affected
- Red Hat OpenStack Platform 18.0 (default configuration affected, according to Red Hat)
- Red Hat OpenStack Services on OpenShift (RHOSO) as described by Red Hat
Fixed in
Unknown.
Workaround
- Restrict access to the metrics endpoint (TCP port 1981) to trusted networks or localhost with firewall rules.
- Set HttpListen to 127.0.0.1:1981 to bind the exporter to localhost only.
- Restart or reload the openstack-network-exporter service after changing HttpListen.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No evidence of exploitation in the wild found; not listed in the CISA KEV catalog according to a secondary tracker.
- No public exploit code known.
- EPSS 0.00282 (low) according to Vulners.
Our recommendation
- Check whether you run OpenStack Platform 18.0 or RHOSO with openstack-network-exporter.
- Verify that the web-config sets both TLS and basic authentication, and that unauthenticated requests are rejected.
- Limit access to port 1981 to Prometheus scrapers and trusted networks.
- Track Red Hat errata and apply the fixed package when available.
- Audit the configuration regularly, because the fallback is silent and logs may not show it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-83535 access.redhat.com
- Red Hat Bugzilla 2526402 bugzilla.redhat.com
- openstack-network-exporter upstream project github.com
- OpenCVE CVE-2026-83535 app.opencve.io
- Vulners RAPID7 entry (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 01:12.
Original description (NVD)
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.