FIND-003 from Project Glasswing AI-SAST audit of openstack-k8s-operators/openstack-network-exporter (audit date 2026-06-12, harness version 0.32.0-57f1ef1). Confirmed exploitable (3/3 TP vote, dynamic validation 2026-07-15).

The basic-auth wrapper in main.go (lines 75-84) is only installed inside the `if config.TlsCert() != "" && config.TlsKey() != ""` branch. If an operator sets `auth-users:` but omits or misconfigures `tls-cert`/`tls-key`, the server falls through to plain `server.ListenAndServe()` with no authentication and no warning. The compiled-in default `HttpListen: ":1981"` binds all interfaces, so in the default/shipped configuration the OVS/OVN dataplane metrics (bridge names, port counters, OVN controller state, host PMD/CPU layout) are exposed to any adjacent network peer that can reach the node on tcp/1981. This is a fail-open authentication design.

Attack pattern: Adjacent-network or same-cluster attacker scrapes http://<node>:1981/metrics to enumerate OVS bridges, OVN cluster state and host topology without credentials.

Affected code: main.go:75-84, config/config.go:79-89

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5, Medium)

Remediation: Apply basicAuthHandler regardless of TLS, and emit a startup warning (or refuse to start) when auth-users is non-empty but TLS is disabled. Change the default http-listen to 127.0.0.1:1981 so that exposure beyond localhost is an explicit operator decision.