CVE-2026-5270 - Vulnerability Details - OpenCVE

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://www.ciena.com/product-security

History

Tue, 14 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Title		Authentication Bypass in Navigator and Blue Planet Products
Weaknesses		CWE-287
References		https://www.ciena.com/product-security

MITRE

Status: PUBLISHED

Assigner: Ciena

Published: 2026-07-14T22:24:34.750Z

Updated: 2026-07-14T22:24:34.750Z

Reserved: 2026-03-31T19:44:41.118Z

Link: CVE-2026-5270

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5270", "assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb", "state": "PUBLISHED", "assignerShortName": "Ciena", "dateReserved": "2026-03-31T19:44:41.118Z", "datePublished": "2026-07-14T22:24:34.750Z", "dateUpdated": "2026-07-14T22:24:34.750Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb", "shortName": "Ciena", "dateUpdated": "2026-07-14T22:24:34.750Z"}, "title": "Authentication Bypass in Navigator and Blue Planet Products", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "CIENA", "product": "Navigator NCS", "versions": [{"status": "affected", "version": "8.1"}], "defaultStatus": "unaffected"}, {"vendor": "CIENA", "product": "MCP", "versions": [{"status": "affected", "version": "<= 8.0"}], "defaultStatus": "unaffected"}, {"vendor": "CIENA", "product": "Planner Plus OnPrem", "versions": [{"status": "affected", "version": "<= 4.1"}], "defaultStatus": "unaffected"}, {"vendor": "Blue Planet", "product": "Inventory", "versions": [{"status": "affected", "version": "<=24.04.001"}, {"status": "affected", "version": "<=23.12.401"}, {"status": "affected", "version": "<=23.08.302"}, {"status": "affected", "version": "<=23.04.701"}], "defaultStatus": "unaffected"}, {"vendor": "Blue Planet", "product": "Orchestration", "versions": [{"status": "affected", "version": "<=24.04.2"}, {"status": "affected", "version": "<=23.12.3"}, {"status": "affected", "version": "<=23.08.4"}, {"status": "affected", "version": "<=23.04.2"}], "defaultStatus": "unaffected"}, {"vendor": "Blue Planet", "product": "Route Optimization & Analysis", "versions": [{"status": "affected", "version": "<=24.04.1.2-R"}, {"status": "affected", "version": "<=23.12.1.6-R"}, {"status": "affected", "version": "<=23.08.1.6-R"}, {"status": "affected", "version": "<=23.04.P01-9-R"}], "defaultStatus": "unaffected"}, {"vendor": "Blue Planet", "product": "Unified Assurance & Analytics", "versions": [{"status": "affected", "version": "<=24.04 MR1"}, {"status": "affected", "version": "<=23.12 MR3"}, {"status": "affected", "version": "<=23.04. MR4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet\u00a0products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls."}]}], "references": [{"url": "https://www.ciena.com/product-security"}], "solutions": [{"lang": "en", "value": "Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.\n\n\n\n\n\n\u00a0\n\n\n\n\n\nRemediation\nand Fixes: \n\n\n\n\n \n \n \n\n\u00a0Products \n\n\n \n \n \n\nRemediated Version\n\n\n \n \n \n \n \n\nBP Inventory\n\n\n \n \n \n\n>=24.08, 24.04.100, 23.12.500, 23.08.400,\n 23.04.800\n\n\n \n \n \n \n \n\nBP Orchestration \n\n\n \n \n \n\n>=24.08, 24.04.3 MR3, 23.12.4 MR4,\n 23.08.5 MR5, \n\n 23.04.4 MR3\n\n\n \n \n \n \n \n\nBP Route Optimization & Analysis\n\n\n \n \n \n\n>=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, \n\n 23.04.P02-1-R\n\n\n \n \n \n \n \n\nBP Unified Assurance & Analytics \n\n\n \n \n \n\n>=24.08, 24.04.MR2, 23.12.MR4\n\n\n \n \n \n \n \n\nNavigator NCS\n\n\n \n \n \n\n>= 8.2, 8.1-P02\n\n\n \n \n \n \n \n\nMCP\n\n\n \n \n \n\n8.0-P04, 7.2-P07\n\n\n \n \n \n \n \n\nPlanner Plus OnPrem\n\n\n \n \n \n\n>= 4.2, 4.1-P01", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Ciena recommends upgrading to the latest\navailable remediated release. For additional details, refer to myciena.com for\ncurrent software versions, fixes, and security advisories.</p>\n\n<p> </p>\n\n<p><b>Remediation\nand Fixes: </b></p>\n\n<table>\n <tbody><tr>\n <td>\n <p><b> Products </b></p>\n </td>\n <td>\n <p><b>Remediated Version</b></p>\n </td>\n </tr>\n <tr>\n <td>\n <p>BP Inventory</p>\n </td>\n <td>\n <p>>=24.08, 24.04.100, 23.12.500, 23.08.400,\n 23.04.800</p>\n </td>\n </tr>\n <tr>\n <td>\n <p>BP Orchestration </p>\n </td>\n <td>\n <p>>=24.08, 24.04.3 MR3, 23.12.4 MR4,\n 23.08.5 MR5, <br>\n 23.04.4 MR3</p>\n </td>\n </tr>\n <tr>\n <td>\n <p>BP Route Optimization & Analysis</p>\n </td>\n <td>\n <p>>=24.08, 24.04.2-3-R, 23.12.2.1-R, 23.08.2.-1-R, <br>\n 23.04.P02-1-R</p>\n </td>\n </tr>\n <tr>\n <td>\n <p>BP Unified Assurance & Analytics </p>\n </td>\n <td>\n <p>>=24.08, 24.04.MR2, 23.12.MR4</p>\n </td>\n </tr>\n <tr>\n <td>\n <p>Navigator NCS</p>\n </td>\n <td>\n <p>>= 8.2, 8.1-P02</p>\n </td>\n </tr>\n <tr>\n <td>\n <p>MCP</p>\n </td>\n <td>\n <p>8.0-P04, 7.2-P07</p>\n </td>\n </tr>\n <tr>\n <td>\n <p>Planner Plus OnPrem</p>\n </td>\n <td>\n <p>>= 4.2, 4.1-P01</p>\n </td>\n </tr>\n</tbody></table>"}]}], "credits": [{"lang": "en", "value": "Special thanks to the team at TDC NET for their contribution.", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.2"}}}}