CVE-2023-49564

The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the HTTP API without providing any valid credentials. The root cause of this vulnerability lies in a weak verification mechanism within the authentication implementation present in the Nginx Podman container on the CBIS/NCS Manager host machine. The risk can be partially mitigated by restricting access to the management network using external firewall.

• CWE-288

• https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/CVE-2023-49564/

Published

Sep 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49556Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows …5.5
• CVE-2023-49557An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49558An issue in YASM 1.3.0.86.g9def allows a remote attacker to …5.5
• CVE-2023-49559An issue in vektah gqlparser open-source-library v.2.5.10 al…3.7
• CVE-2023-4956A flaw was found in Quay. Clickjacking is when an attacker u…4.3
• CVE-2023-49563Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v…6.1
• CVE-2023-49565The cbis_manager Podman container is vulnerable to remote co…8.4
• CVE-2023-49566 In Apache Linkis <=1.5.0, due to the lack of effective filt…8.8
• CVE-2023-49567A vulnerability has been identified in the Bitdefender Total…6.8
• CVE-2023-49568A denial of service (DoS) vulnerability was discovered in go…7.5
• CVE-2023-49569A path traversal vulnerability was discovered in go-git vers…9.8
• CVE-2023-4957A vulnerability of authentication bypass has been found on a…4.3