Nokia CBIS/NCS Manager API Vulnerability Allows Attackers to Bypass Authentication

According to Orange Cert, on 18 September 2025 a critical authentication bypass vulnerability affecting Nokia’s CBIS (CloudBand Infrastructure Software) and NCS (Nokia Container Service) Manager API, CVE-2023-49564, was publicly disclosed. The flaw carries a CVSS v3.1 score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and enables attackers to traverse unrestricted API endpoints without valid credentials, potentially compromising sensitive infrastructure components.

Nokia confirmed that the vulnerability affects CBIS 22 and NCS 22.12 installations running the default Manager API configurations, and exploitation requires only network connectivity to the management interface. The issue resides in the authentication verification in the Nginx Podman container used by CBIS 22 and NCS 22.12 Manager hosts, allowing an unauthenticated adversary to bypass credential checks by injecting a specially formatted HTTP header.

Nokia has released patches for CBIS 22 FP1 MP1.2 and NCS 22.12 MP3, which replace the vulnerable container image to enforce proper header validation and session token verification. Administrators are urged to restrict network access to management interfaces, monitor for anomalous HTTP header patterns, and consider MFA for privileged access to further reduce risk.