openstack-network-exporter CVE-2026-83535

Exploitation requires that an operator has enabled user/basic authentication on openstack-network-exporter WHILE omitting or misconfiguring TLS - this exact non-default, inconsistent configuration triggers the silent fail-open bypass. The attacker must also hold an adjacent network position (same L2 segment or reachable management/dataplane network) to the exporter endpoint. Limiting factors: default or TLS-correct deployments are not affected, no exploitation is possible if authentication is not configured in this broken combination, and the attacker gains read-only metric visibility only (no integrity or availability impact). This is a configuration-dependent, adjacency-limited disclosure rather than a remote-from-anywhere unauthenticated flaw.

This is a conditional, misconfiguration-dependent information-disclosure flaw whose real-world risk is moderate and narrower than the 7.4 CVSS might suggest. The input CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) conflicts with the description in two ways that must be verified: the description explicitly states an 'adjacent network attacker,' which is AV:A, not the AV:N in the vector; and the described impact is purely read-only metric disclosure (enumerate bridge names, port counters, OVN state, topology), which does not support the I:H (integrity) rating in the vendor vector - only confidentiality is clearly affected. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The AC:H rating is appropriate because exploitation is gated on a specific operator mistake (authentication enabled while TLS is omitted/misconfigured), making this a priority only for environments confirmed to run that exact fail-open configuration rather than a broad, default-exposure emergency.

An operator deploys openstack-network-exporter with basic authentication enabled but without (or with broken) TLS. Because authentication silently fails open under this condition, an attacker positioned on the same L2 segment or adjacent management network simply queries the metrics endpoint and receives OVS/OVN dataplane telemetry without any credentials. No public POC is referenced; the 'exploit' is effectively an unauthenticated HTTP(S) scrape against the misconfigured exporter.