CVE-2026-36500: Controller Path Traversal Vulnerability

CVE-2026-36500 Overview

CVE-2026-36500 is a directory traversal vulnerability in the cluster-admin:backup-datastore component of OpenDaylight Controller v12.0.5. Attackers can send a crafted request to traverse outside the intended backup directory and access arbitrary files on the host filesystem. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

The vulnerability is network-exploitable, requires no authentication, and no user interaction. Successful exploitation grants attackers read access to sensitive files and the ability to write backup data to unintended locations, threatening confidentiality and availability of the controller.

Critical Impact
Unauthenticated remote attackers can read sensitive files and disrupt controller availability through path traversal in the backup-datastore RPC.

Affected Products

OpenDaylight Controller v12.0.5
cluster-admin:backup-datastore RPC component
Deployments running the affected stable-titanium release branch

Discovery Timeline

2026-06-05 - CVE-2026-36500 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-36500

Vulnerability Analysis

The vulnerability resides in the cluster-admin:backup-datastore RPC exposed by the OpenDaylight Controller. This RPC accepts a file path parameter that controls where the controller writes a snapshot of its datastore. The implementation fails to canonicalize or restrict the supplied path.

An attacker submits a crafted RPC request containing path traversal sequences such as ../ to escape the intended backup directory. The controller process then operates on file paths outside the expected sandbox, exposing arbitrary host filesystem locations to read or write operations.

Because OpenDaylight commonly runs with elevated privileges in network operator environments, exploitation can disclose configuration files, credentials stored on disk, and TLS keys. Attackers can also overwrite system files, degrading controller availability and pivoting toward additional compromise of the software-defined networking (SDN) control plane.

Root Cause

The root cause is improper input validation of the destination path passed to the backup operation. The component concatenates attacker-controlled input into a filesystem path without normalizing the result or enforcing a base directory check, satisfying the conditions of [CWE-22].

Attack Vector

Exploitation occurs over the network against the controller's NETCONF or RESTCONF interface that exposes the cluster-admin:backup-datastore RPC. The attacker submits a request with a traversal payload in the file path field. A public proof-of-concept is referenced in the ODL Path Traversal repository.

No authentication is required in vulnerable configurations, and the attack complexity is low. See the OpenDaylight Release Notes for fixed version details.

Detection Methods for CVE-2026-36500

Indicators of Compromise

RESTCONF or NETCONF requests to the cluster-admin:backup-datastore operation containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths outside the configured backup directory.
Unexpected files written outside $KARAF_HOME or the designated backup folder, particularly in /etc, /root, or controller configuration directories.
Backup-datastore RPC calls originating from untrusted source IPs or outside maintenance windows.

Detection Strategies

Parse OpenDaylight audit and Karaf logs for invocations of cluster-admin:backup-datastore and flag any file-path argument containing traversal sequences or absolute paths.
Deploy network signatures on management-plane traffic that inspect RESTCONF JSON and XML payloads for traversal patterns targeting the backup RPC.
Establish a baseline of legitimate backup destinations and alert on deviations.

Monitoring Recommendations

Forward Karaf, RESTCONF, and NETCONF logs to a central SIEM and correlate backup RPC events with source identity and network location.
Monitor filesystem integrity on controller hosts for unexpected file creation or modification outside the backup directory.
Track authentication failures and anonymous access attempts to controller northbound APIs.

How to Mitigate CVE-2026-36500

Immediate Actions Required

Restrict network access to the OpenDaylight northbound RESTCONF and NETCONF interfaces to trusted management subnets only.
Enforce authentication and authorization on the cluster-admin:backup-datastore RPC and disable anonymous access.
Audit recent invocations of the backup RPC and inspect filesystem locations referenced by file-path arguments for tampering.

Patch Information

Upgrade beyond OpenDaylight Controller v12.0.5 to a release containing the path traversal fix. Consult the OpenDaylight Release Notes for the specific fixed version and upgrade guidance.

Workarounds

Place the controller behind a reverse proxy that filters RESTCONF payloads and rejects requests containing traversal sequences in the backup RPC body.
Run the controller process under a least-privilege account with filesystem ACLs that prevent writes outside the designated backup directory.
Use mandatory access controls such as SELinux or AppArmor profiles to confine the controller to approved filesystem paths.

bash

# Example: restrict RESTCONF access at the network layer
iptables -A INPUT -p tcp --dport 8181 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8181 -j DROP