CVE-2026-12392

Publié : 2 octobre 2026

Modifié : 3 octobre 2026

Score CVSS

5.3

MEDIUM

Description détaillée

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Références et Patchs

https://bugs.launchpad.net/maas/+bug/2153942 https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8 https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9d https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9b https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31e https://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79

Dernières Vulnérabilités

CVE-2026-96451

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

VOIR DÉTAILS

CVE-2026-103342

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

VOIR DÉTAILS

CVE-2026-103065

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

VOIR DÉTAILS