CVE-2026-83535
Description
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.
Statement
This vulnerability is rated as Moderate impact because unauthorized access is restricted to read-only network telemetry and host metrics, requiring adjacent or intra-cluster network connectivity to reach the exporter daemon. In Red Hat OpenStack Services on OpenShift (RHOSO), the network exporter exposes dataplane metrics across cluster interfaces when running without cryptographic transport configuration. While this exposes infrastructure topology and performance indicators to unauthenticated actors, it does not grant administrative control, arbitrary code execution, or modification of the underlying Open vSwitch and Open Virtual Network environments.
Mitigation
To mitigate this issue, restrict access to the `openstack-network-exporter` metrics endpoint (TCP port 1981) to trusted networks or localhost. This can be achieved by configuring firewall rules to block external access to port 1981 or by explicitly setting the `HttpListen` configuration to `127.0.0.1:1981` to bind only to the localhost interface. If the `HttpListen` configuration is changed, the `openstack-network-exporter` service may require a restart or reload for the changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat CVSS v3 Score Explanation
Reconciled from source finding FIND-002 (migration 2026-09-01)
Understanding the Weakness (CWE)
Confidentiality,Access Control
Technical Impact: Read Application Data; Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
