CVE-2026-129357: Linux Foundation Magma Host Middleware middleware.ts hostOrgMiddleware authorization
A vulnerability was determined in Linux Foundation Magma up to 1.9.0. This issue affects the function hostOrgMiddleware of the file nms/server/host/middleware.ts of the component Host Middleware. This manipulation of the argument role causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low privileges can exploit the missing authorization condition. No user interaction is required.
Which deployments are known to be affected?
Linux Foundation Magma versions up to 1.9.0 are identified as affected, specifically the Host Middleware component in nms/server/host/middleware.ts.
What access could an attacker gain through this flaw?
The issue can affect confidentiality, integrity, and availability at low impact levels. The provided data attributes this to manipulation of the role argument in hostOrgMiddleware, resulting in missing authorization.
Is exploit code available?
Yes. The issue is flagged as having a proof of concept, and the exploit has been publicly disclosed.