CVE-2026-12392: RPC secret disclosure via vendor data endpoint in Canonical MAAS
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Canonical MAASto a version that resolves this vulnerability.Fixed in 3.4.10 - Upgrade
Upgrade
Canonical MAASto a version that resolves this vulnerability.Fixed in 3.5.14 - Upgrade
Upgrade
Canonical MAASto a version that resolves this vulnerability.Fixed in 3.6.5 - Upgrade
Upgrade
Canonical MAASto a version that resolves this vulnerability.Fixed in 3.7.3 - Upgrade
Upgrade
Canonical MAASto a version that resolves this vulnerability.Fixed in 3.8.0
Event History
Frequently Asked Questions
Which MAAS deployments are exposed to this issue?
Exposure requires a target machine that was deployed with the "register as rack" option enabled. An unauthenticated attacker must also be able to obtain or infer that machine's system ID and query the preseed/metadata server.
What could an attacker obtain through successful exploitation?
The attacker can retrieve the RPC secret in plaintext from the vendor data metadata endpoint. The issue is limited in the provided data to disclosure of that secret; no integrity or availability impact is described.
Which versions contain fixes?
The vulnerability affects MAAS versions before 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0. Updating to the applicable listed version or later addresses the issue.