CVE-2026-5267: Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 10.0-P01C - Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 8.0-P06B - Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 8.1-P06A - Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 8.2-P07 - Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 9.0-P05B - Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 9.1-P05A - Upgrade
Upgrade
Ciena Navigator Network Control Suite (NCS)to a version that resolves this vulnerability.Fixed in 9.2-P02A
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with network access to the affected Navigator NCS service could access the event-streaming API. The available information does not identify any additional privileges or user interaction requirements.
What information could be exposed?
The event stream may expose sensitive information, including session tokens as indicated by the vulnerability title. The provided details do not specify which event types or token scopes are affected.
How can I determine whether my deployment is exposed?
Determine whether the Navigator NCS event-streaming service is reachable from networks accessible to unauthenticated users. The provided information does not include affected versions, endpoint paths, or detection indicators.