Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem

An attacker can exploit CVE-2026-23818 by crafting a malicious URL that redirects an authenticated user to a fake login page. The unsuspecting user, believing they are logging into the legitimate Aruba 5G Core interface, enters their credentials, which are then captured by the attacker. This stolen information can then be used to gain unauthorized access to the system and potentially compromise sensitive data. The blast radius is significant, as a successful attack could grant the attacker control over the entire Private 5G Core network. This vulnerability shares similarities with other open redirect attacks, where social engineering is often the primary attack vector.

Organizations utilizing HPE Aruba Networking Private 5G Core On-Prem, particularly those relying on the GUI for user authentication, are at risk. Shared hosting environments where multiple tenants share the same infrastructure are also at increased risk, as a compromise of one tenant could potentially expose credentials for others. Legacy configurations with weak password policies exacerbate the risk.

• aruba / web:

curl -I <vulnerable_url_with_redirect>

Inspect the response headers for a redirect to an unexpected or attacker-controlled domain. • aruba / web:

grep -i redirect /var/log/apache2/access.log | grep <vulnerable_domain>

Search access logs for redirect requests originating from the vulnerable domain. • aruba / web:

curl -v <vulnerable_url_with_redirect> 2>&1 | grep Location

Verbose curl output to check the 'Location' header for malicious redirects.

1. 2026-04-07Disclosure

   disclosure

1. Reserviert2026-01-16
2. Veröffentlicht2026-04-07
3. EPSS aktualisiert2026-04-15

The primary mitigation for CVE-2026-23818 is to upgrade HPE Aruba Networking Private 5G Core On-Prem to version 1.25.4 or later. Before upgrading, review the release notes for any potential compatibility issues or breaking changes. As a temporary workaround, implement strict URL filtering on your web proxies or firewalls to block redirects to untrusted domains. Consider implementing multi-factor authentication (MFA) to add an extra layer of security, even if an attacker manages to steal credentials. Regularly monitor login activity for any suspicious patterns.