MAAS RPC Secret Leak Vulnerability (CVE-2026-12392) and Fix

Vulnerability Overview Vulnerability Name: RPC secret leak Vulnerability Description: If an attacker can guess the machine's system ID (via brute force, external disclosure, or by guessing the MAC address and sending a TFTP request to the GRUB configuration endpoint), and the machine is deployed with the "register as rack" option, the plaintext response endpoint will return an RPC key. Leaking an RPC key allows an attacker to register additional rack controllers, leak BRC keys, and execute various other attacks. Expected Behavior: MAAS should not leak RPC keys. Actual Behavior: MAAS provides RPC keys in endpoints accessible via leaked API keys. Scope Affected Versions: - MAAS 3.4 - MAAS 3.5 - MAAS 3.6 - MAAS 3.7 Severity: High Status: Fixed Assignee: Jacopo Rota, Dariusz Gadowski Remediation Fixed Versions: - MAAS 3.8.0 - MAAS 3.4.10 - MAAS 3.5.13 - MAAS 3.6.5 - MAAS 3.7.3 Remediation Details: The "deploy as rack" feature has been disabled in version 3.8.0 and later. It has also been disabled in the next patch releases for supported versions 3.7 and 3.6. Versions prior to 3.5 will be handled by the Security Engineering Team (SEC). POC Code or Exploit Code Steps: 1. Disclose the system ID of the machine being deployed as a rack controller. 2. Retrieve the token via the preseed endpoint. 3. Request vendor data from the metadata server. CVE References CVE ID: CVE-2026-12392 Additional Information Reporter: Jacopo Rota Report Date: 2026-05-27 Stargazers: 1 Comments: - Jacopo Rota (r00ta) wrote on 2026-05-28: During the vulnerability committee, we decided to disable the "deploy as rack" feature in 3.8.0 and will also disable it in the next patch releases for all supported versions 3.7 and 3.6. Versions prior to 3.5 will be handled by the Security Engineering Team (SEC). - Federico Quattrin (federicoquattrin) wrote on 2026-06-16: Hi! CVE-2026-12392 has been reserved for this issue. - Jacopo Rota (r00ta) wrote on 2026-06-26: In MAAS: Milestone: 3.8.0 - 3.8.0; Assignee: None - Jacopo Rota (r00ta); Status: Marked - Fixed. - Federico Quattrin (federicoquattrin) wrote 5 hours ago: Type: Private Security - Public.

Goal Reached Thanks to every supporter — we hit 100%!

MAAS RPC Secret Leak Vulnerability (CVE-2026-12392) and Fix