Medium 5.3Published Oct 2, 2026

CVE-2026-12392RPC secret disclosure via vendor data endpoint in Canonical MAAS

Updated under an hour ago (2026-10-19 10:00 UTC)

Does this affect you?

It affects Canonical MAAS. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Canonical MAAS

Exploited in the last 30 days

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: canonical
NVD analysis: Awaiting Analysis
Record last updated: Oct 4, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Canonical MAAS canonical:maas (from the name)	from 3.4.0 before 3.4.10; from 3.5.0 before 3.5.14; from 3.6.0 before 3.6.5; from 3.7.0 before 3.7.3; before 3.8.0	CNA record

References

https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9bpatch
https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31epatch
https://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79patch
https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8patch
https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9dpatch
https://bugs.launchpad.net/maas/+bug/2153942vendor-advisory, issue-tracking

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.