Critical authentication bypass flaw reported in Nokia's CBIS and NCS Management Platforms
Take action: If you're using Nokia CBIS version 22 or NCS version 22.12, make sure it's isolated and accessible only from trusted networks. Then plan a quick upgrade to CBIS 22 FP1 MP1.2 or NCS 22.12 MP3.
Learn More
Nokia has patched a critical authentication bypass vulnerability in its CloudBand Infrastructure Software (CBIS) and Nokia Container Service (NCS) Manager API that could allow attackers to gain complete unauthorized access to sensitive infrastructure management functions.
Orange Cert publicly disclosed the vulnerability on September 18, 2025, following their discovery during routine security assessments.
The vulnerability is tracked as CVE-2023-49564 (CVSS score 9.6), and is caused by a weak verification mechanism within the authentication implementation present in the Nginx Podman container running on CBIS and NCS Manager host machines. The authentication layer fails to properly validate custom HTTP headers, enabling adversaries to reach unrestricted API endpoints without providing any valid credential by injecting specially formatted HTTP headers in their requests.
Affected versions:
- Nokia CBIS (CloudBand Infrastructure Software) version 22
- Nokia Container Service (NCS) version 22.12
Patched versions:
- CBIS 22 FP1 MP1.2
- NCS 22.12 MP3
Nokia confirmed that the vulnerability affects installations running the default Manager API configurations. Organizations should immediately verify their current versions and upgrade to the patched releases to restore proper header validation and authentication enforcement.
Administrators are urged to apply these updates and to restrict network access to management interfaces using microsegmentation and firewall rules, allowing connections only from authorized administrative hosts.
