Openstack-Network-Exporter - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openstack-network-exporter/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 20:32:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-83535 Authentication Bypass in OpenStack Network Exporterhttps://feed.craftedsignal.io/briefs/2026-10-openstack-network-exporter-bypass/Mon, 12 Oct 2026 20:32:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openstack-network-exporter-bypass/A fail-open vulnerability in openstack-network-exporter allows adjacent network attackers to bypass authentication and exfiltrate sensitive OVS and OVN dataplane metrics when TLS is not properly configured.CVE-2026-83535 is a security vulnerability in the openstack-network-exporter component caused by an insecure fail-open design. When an operator enables user authentication but fails to properly configure or explicitly omits Transport Layer Security (TLS), the authentication mechanism is bypassed silently. This flaw allows attackers on the adjacent network to access highly sensitive dataplane metrics from Open vSwitch (OVS) and Open Virtual Network (OVN) without providing credentials. By querying these endpoints, an unauthorized party can obtain detailed host topology, bridge configurations, active port counters, and internal controller states. This information disclosure provides significant reconnaissance value to an attacker, potentially mapping the internal network structure of a cloud environment to facilitate further exploitation.

Impact

The vulnerability results in unauthorized information disclosure of critical network infrastructure telemetry. Impacted organizations include those running OpenStack environments where network exporters are deployed. Successful exploitation enables adjacent network attackers to map host topology and OVN controller states, potentially revealing details about the internal architecture and traffic patterns of the cloud environment. There is currently no reported impact on system integrity, but the exposure of configuration data serves as a foundation for further network-based attacks.

Recommendation

  • Immediately audit current openstack-network-exporter deployments to ensure TLS is enforced alongside user authentication.
  • Disable the network-exporter until TLS can be verified and implemented if immediate enforcement is not possible.
  • Configure host-based firewalls or network access control lists (ACLs) to restrict access to the exporter's listening port to trusted management IPs only.
  • Monitor network traffic logs for unauthorized access attempts to the openstack-network-exporter port, looking for requests that do not include valid authentication headers or originate from unexpected subnets.
]]>highadvisoryvulnerabilitycloud-securityinformation-disclosure