What’s Vulnerable › Vulnerabilities

CVE-2026-12392: RPC secret disclosure via vendor data endpoint in Canonical MAAS

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-02 · updated 2026-10-06
• Weakness: CWE-200

Description

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

Affected products

• Ubuntu MAAS: from 3.4.0 before 3.4.10; from 3.5.0 before 3.5.14; from 3.6.0 before 3.6.5; from 3.7.0 before 3.7.3; before 3.8.0 — fixed in 3.4.10, 3.5.14, 3.6.5, 3.7.3, 3.8.0

How to fix

Upgrade to a fixed version: Ubuntu MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3. Check the vendor advisory for mitigations.

References

• https://bugs.launchpad.net/maas/+bug/2153942
• https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8
• https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9d
• https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9b
• https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31e
• https://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79

Get alerted when CVE-2026-12392 or the next vulnerability affects your stack