REDHAT-BUG-2526402: Medium severity Openstack openstack-network-exporter vulnerability
FIND-003 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).
The basic-auth wrapper in main.go (lines 75-84) is only installed inside the if config.TlsCert() != "" && config.TlsKey() != "" branch. If an operator sets auth-users: but omits or misconfigures tls-cert/tls-key, the server falls through to plain server.ListenAndServe() with no authentication and no warning. The compiled-in default HttpListen: ":1981" binds all interfaces, so in the default/shipped configuration the OVS/OVN dataplane metrics (bridge names, port counters, OVN controller state, host PMD/CPU layout) are exposed to any adjacent network peer that can reach the node on tcp/1981. This is a fail-open authentication design.
Attack pattern: Adjacent-network or same-cluster attacker scrapes http://<node>:1981/metrics to enumerate OVS bridges, OVN cluster state and host topology without credentials.
Affected code: main.go:75-84, config/config.go:79-89
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5, Medium)
Remediation: Apply basicAuthHandler regardless of TLS, and emit a startup warning (or refuse to start) when auth-users is non-empty but TLS is disabled. Change the default http-listen to 127.0.0.1:1981 so that exposure beyond localhost is an explicit operator decision.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Change the compiled-in default HTTP listen address from :1981 to 127.0.0.1:1981 so metrics are not exposed beyond localhost by default.
openstack-network-exporter HttpListen = 127.0.0.1:1981 - Configuration
Install basicAuthHandler regardless of whether tls-cert and tls-key are configured; when auth-users is non-empty but TLS is disabled or misconfigured, emit a startup warning or refuse to start instead of falling through to unauthenticated server.ListenAndServe().
openstack-network-exporter basicAuthHandler = apply regardless of TLS
Event History
Frequently Asked Questions
Is a default deployment reachable by other systems on the network?
The compiled-in default HTTP listener is :1981, which binds all interfaces. Any adjacent-network peer that can reach TCP port 1981 on the node can access the metrics endpoint when authentication is not installed.
What configuration condition causes authentication to be bypassed?
The basic-auth wrapper is installed only when both tls-cert and tls-key are configured. If auth-users is set but either TLS setting is omitted or misconfigured, the server falls back to unauthenticated HTTP without a warning.
What does an attacker need to exploit this issue?
No credentials, user interaction, or prior privileges are required. An adjacent-network or same-cluster attacker only needs network access to the node's TCP/1981 listener and can request /metrics.
What information could an unauthenticated requester obtain?
The exposed metrics can reveal OVS bridge names, port counters, OVN controller or cluster state, and host PMD/CPU layout. The reported impact is confidentiality only; no integrity or availability impact is identified.
How can operators determine whether they are exposed?
Check whether the exporter is listening on TCP/1981 and whether both tls-cert and tls-key are validly configured. A deployment with auth-users configured but missing or misconfigured TLS settings should be treated as unauthenticated.