OpenStack Network Exporter Vulnerability Allowing Unauthorized Access to Sensitive Metrics
CVE-2026-83535

7.4HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openstack Platform 18.0
Vendor
CVE Published:
12 October 2026

What is CVE-2026-83535?

A security flaw exists in OpenStack Network Exporter, where improperly configured transport layer security (TLS) allows an attacker on the adjacent network to bypass the basic user authentication mechanisms. This flaw can lead to unauthorized access to sensitive data, including Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics. Attackers can exploit this issue to enumerate critical information such as bridge names, port counters, OVN controller states, and host topologies, facilitating potential information disclosure without authentication.

References

https://access.redhat.com/security/cve/CVE-2026-83535
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526402
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.