Log in Start free

Vulnerability · Published Oct 2, 2026 · Assigned by canonical

CVE-2026-12392RPC secret disclosure via vendor data endpoint in Canonical MAAS

Medium 5.3

In plain English

A medium-severity information exposure in MAAS from Canonical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 80.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

Affected products (as reported)

VendorProductVersions
Canonical MAAS 3.4.0 – before 3.4.103.5.0 – before 3.5.143.6.0 – before 3.6.53.7.0 – before 3.7.30 – before 3.8.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References