CVE-2026-83535 Overview
A flaw in openstack-network-exporter allows adjacent network attackers to bypass basic authentication when Transport Layer Security (TLS) is omitted or misconfigured. The exporter silently fails open, serving sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without requiring credentials. Attackers can enumerate bridge names, port counters, OVN controller state, and host topology. This information disclosure classifies under [CWE-208] and provides reconnaissance data useful for subsequent attacks against the virtualization dataplane.
Critical Impact
Unauthenticated adjacent attackers can harvest OVS and OVN dataplane metrics, exposing network topology and operational state across OpenStack environments.
Affected Products
- openstack-network-exporter (operator-configured deployments without TLS)
- OpenStack environments exposing OVS metrics endpoints
- OVN controller instances monitored by the affected exporter
Discovery Timeline
- 2026-10-12 - CVE-2026-83535 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-83535
Vulnerability Analysis
The openstack-network-exporter exposes Prometheus-style metrics describing the OVS and OVN dataplane. Operators can enable HTTP basic authentication to restrict access. The exporter couples that authentication layer to TLS. When TLS configuration is absent or malformed, the authentication check is skipped rather than denied, producing a fail-open condition. Metrics continue to serve over plaintext without credential enforcement. This behavior violates expected secure defaults for monitoring endpoints and falls under Observable Discrepancy weaknesses [CWE-208].
Root Cause
The root cause is a flawed conditional in the authentication middleware that treats missing TLS configuration as a reason to bypass credential checks instead of refusing to start or denying requests. The design assumes credentials only need protection when transport encryption is active, ignoring that unauthenticated access over plaintext is more permissive than authenticated access over plaintext.
Attack Vector
An attacker on an adjacent network segment with reachability to the exporter's metrics port issues HTTP GET requests to the /metrics endpoint. No credentials are supplied. The exporter returns full OVS and OVN telemetry, including bridge definitions, interface counters, and OVN controller state. The attacker enumerates virtual network topology, identifies tenant isolation boundaries, and maps hypervisor hosts. The data supports lateral movement planning and targeted attacks against identified components.
No verified exploitation code is published. Refer to the Red Hat CVE-2026-83535 Advisory and Red Hat Bug Report #2526402 for vendor technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-83535
Indicators of Compromise
- Unauthenticated HTTP requests to the exporter /metrics endpoint originating from unexpected source addresses on management or dataplane networks.
- Exporter process serving metrics over plaintext HTTP despite operator-configured basic authentication.
- Access log entries showing successful 200 OK responses to /metrics without an Authorization header.
Detection Strategies
- Audit exporter configuration files to confirm whether TLS parameters are present, valid, and loaded at service start.
- Baseline expected scrapers (Prometheus servers) and alert on metric pulls from unknown clients.
- Correlate network flow records with exporter ports to identify untrusted peers reaching the metrics endpoint.
Monitoring Recommendations
- Forward exporter access logs to a centralized SIEM and alert on requests lacking authentication headers.
- Monitor OpenStack control plane segments for cross-tenant traffic reaching exporter ports.
- Track exporter service restarts and configuration changes to detect silent downgrades from TLS to plaintext.
How to Mitigate CVE-2026-83535
Immediate Actions Required
- Apply the fixed openstack-network-exporter package when distributed by Red Hat or upstream maintainers.
- Restrict network access to the exporter port using host firewalls or security groups so only authorized scrapers can connect.
- Validate that TLS is configured and loaded; verify authentication is enforced by sending a test request without credentials.
Patch Information
Consult the Red Hat CVE-2026-83535 Advisory for package availability and errata details. Operators tracking upstream progress should reference Red Hat Bug Report #2526402 for the authoritative fix status.
Workarounds
- Deploy the exporter behind a reverse proxy that enforces TLS termination and HTTP basic authentication independently.
- Bind the exporter listener to a management-only interface unreachable from tenant and adjacent networks.
- Use network policies or iptables rules to allow metrics scraping only from the designated Prometheus server address.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
