Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-5270

Authentication Bypass in Navigator and Blue Planet Products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Ciena

Description

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CIENA Navigator NCS

Default version status: unaffected

  • 8.1affected

CIENA MCP

Default version status: unaffected

  • <= 8.0affected

CIENA Planner Plus OnPrem

Default version status: unaffected

  • <= 4.1affected

Blue Planet Inventory

Default version status: unaffected

  • <=24.04.001affected
  • <=23.12.401affected
  • <=23.08.302affected
  • <=23.04.701affected

Blue Planet Orchestration

Default version status: unaffected

  • <=24.04.2affected
  • <=23.12.3affected
  • <=23.08.4affected
  • <=23.04.2affected

Blue Planet Route Optimization & Analysis

Default version status: unaffected

  • <=24.04.1.2-Raffected
  • <=23.12.1.6-Raffected
  • <=23.08.1.6-Raffected
  • <=23.04.P01-9-Raffected

Blue Planet Unified Assurance & Analytics

Default version status: unaffected

  • <=24.04 MR1affected
  • <=23.12 MR3affected
  • <=23.04. MR4affected

References