RPC secret disclosure via vendor data endpoint in Canonical MAAS
Priority LOW 30CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00273 19th percentileScored 2026-11-07
Fix Fixed MAAS (Canonical): 3.4.10, 3.5.14, 3.6.5 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | MAAS | 3.4.0 to before 3.4.10; 3.5.0 to before 3.5.14; 3.6.0 to before 3.6.5; 3.7.0 to before 3.7.3; before 3.8.0 | 3.4.10, 3.5.14, 3.6.5, 3.7.3, 3.8.0 | Patch available | CNA |
- MAAS VendorCanonical Affected 3.4.0 to before 3.4.10; 3.5.0 to before 3.5.14; 3.6.0 to before 3.6.5; 3.7.0 to before 3.7.3; before 3.8.0 Fixed in 3.4.10, 3.5.14, 3.6.5, 3.7.3, 3.8.0 Patch available CNA
Remediation
- Fix · CNA MAAS (Canonical) Fixed in 3.4.10, 3.5.14, 3.6.5, 3.7.3, 3.8.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12392
- 2026-10-03 Alias added: GHSA-3r9p-96x8-39gw
- 2026-10-03 CISA SSVC decision points changed
- 2026-10-04 Weakness changed · CISA ADP
References
Patch 5
- https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9b
- https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31e
- https://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79
- https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8
- https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9d
More Canonical vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-12392 · CVE Program
- CVE-2026-12392 · NVD
- FIRST EPSS
- GHSA-3r9p-96x8-39gw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences