REDHAT-BUG-2526402: Medium severity Openstack openstack-network-exporter vulnerability
FIND-003 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).
The basic-auth wrapper in main.go (lines 75-84) is only installed inside the if config.TlsCert() != "" && config.TlsKey() != "" branch. If an operator sets auth-users: but omits or misconfigures tls-cert/tls-key, the server falls through to plain server.ListenAndServe() with no authentication and no warning. The compiled-in default HttpListen: ":1981" binds all interfaces, so in the default/shipped configuration the OVS/OVN dataplane metrics (bridge names, port counters, OVN controller state, host PMD/CPU layout) are exposed to any adjacent network peer that can reach the node on tcp/1981. This is a fail-open authentication design.
Attack pattern: Adjacent-network or same-cluster attacker scrapes http://<node>:1981/metrics to enumerate OVS bridges, OVN cluster state and host topology without credentials.
Affected code: main.go:75-84, config/config.go:79-89
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5, Medium)
Remediation: Apply basicAuthHandler regardless of TLS, and emit a startup warning (or refuse to start) when auth-users is non-empty but TLS is disabled. Change the default http-listen to 127.0.0.1:1981 so that exposure beyond localhost is an explicit operator decision.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the compiled-in default HTTP listen address from :1981 to 127.0.0.1:1981 so metrics are not exposed beyond localhost by default.
openstack-network-exporter HttpListen = 127.0.0.1:1981 - Configuration
Install basicAuthHandler regardless of whether tls-cert and tls-key are configured; when auth-users is non-empty but TLS is disabled or misconfigured, emit a startup warning or refuse to start instead of falling through to unauthenticated server.ListenAndServe().
openstack-network-exporter basicAuthHandler = apply regardless of TLS