Bug 2526402 (CVE-2026-83535)

Summary:	CVE-2026-83535 openstack-network-exporter: Basic-auth uses plaintext password storage and non-constant-time comparison
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-31 16:32:48 UTC

FIND-003 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).

The basic-auth wrapper in main.go (lines 75-84) is only installed inside the `if config.TlsCert() != "" && config.TlsKey() != ""` branch. If an operator sets `auth-users:` but omits or misconfigures `tls-cert`/`tls-key`, the server falls through to plain `server.ListenAndServe()` with no authentication and no warning. The compiled-in default `HttpListen: ":1981"` binds all interfaces, so in the default/shipped configuration the OVS/OVN dataplane metrics (bridge names, port counters, OVN controller state, host PMD/CPU layout) are exposed to any adjacent network peer that can reach the node on tcp/1981. This is a fail-open authentication design.

Attack pattern: Adjacent-network or same-cluster attacker scrapes http://<node>:1981/metrics to enumerate OVS bridges, OVN cluster state and host topology without credentials.

Affected code: main.go:75-84, config/config.go:79-89

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5, Medium)

Remediation: Apply basicAuthHandler regardless of TLS, and emit a startup warning (or refuse to start) when auth-users is non-empty but TLS is disabled. Change the default http-listen to 127.0.0.1:1981 so that exposure beyond localhost is an explicit operator decision.