Medium severity · published Oct 2, 2026
CVE-2026-12392
RPC secret disclosure via vendor data endpoint in Canonical MAAS
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MAAS · Canonical
3.4.0 before 3.4.10; 3.5.0 before 3.5.14; 3.6.0 before 3.6.5; 3.7.0 before 3.7.3; before 3.8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12392
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12392
patch
https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9b
patch
https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31e
patch
https://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79
patch
https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8
patch
https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9d
vendor-advisory
https://bugs.launchpad.net/maas/+bug/2153942
More from MAAS
6.5
CVE-2025-7044
Privilege Escalation in MAAS via Websocket Request Manipulation
–
CVE-2013-1058
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM)…
–
CVE-2013-1057
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration…