CVE-2026-129360: Linux Foundation Magma Obsidian REST operator.go authentication spoofing
A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. An attacker can manipulate the X-Magma-Client-Cert-Serial argument to spoof authentication.
Which deployments should be considered affected?
Linux Foundation Magma versions up to and including 1.9.0 are identified as affected. The issue is associated with the Obsidian REST component and the operator.go file under orc8r/cloud/go/services/obsidian/access/.
How can I determine whether my environment may be vulnerable?
Verify the deployed Magma version and whether the Obsidian REST component is present. Systems running version 1.9.0 or earlier with that component should be treated as potentially affected.