CVE-2026-12392

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2026-10-02

Modified

2026-10-06

Record from

the NVD, synced 2026-10-19

References

• https://bugs.launchpad.net/maas/+bug/2153942
• https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8
• https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9d
• https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9b
• https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31e

Check your stackJSON