CVE-2026-12392
published 2026-10-02CVE-2026-12392: An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.27%
18.7th percentile
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | maas | < 3.8.0 | 3.8.0 |
| canonical | maas | >= 3.4.0 < 3.4.10 | 3.4.10 |
| canonical | maas | >= 3.5.0 < 3.5.14 | 3.5.14 |
| canonical | maas | >= 3.6.0 < 3.6.5 | 3.6.5 |
| canonical | maas | >= 3.7.0 < 3.7.3 | 3.7.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Canonical Maas up to 3.7.x Vendor Data Metadata Endpoint missing encryption
vuldb·2026-10-02·CVSS 5.3
CVE-2026-12392 [MEDIUM] Canonical Maas up to 3.7.x Vendor Data Metadata Endpoint missing encryption
A vulnerability classified as problematic was found in Canonical Maas up to 3.4.9/3.5.13/3.6.4/3.7.2/3.7.x. The affected element is an unknown function of the component Vendor Data Metadata Endpoint. Such manipulation leads to missing encryption of sensitive data.
This vulnerability is referenced as CVE-2026-12392. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
GHSA
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the ven
ghsa_unreviewed·2026-10-02
CVE-2026-12392 [MEDIUM] An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the ven
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.launchpad.net/maas/+bug/2153942https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9dhttps://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9bhttps://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31ehttps://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79
2026-10-02
Published