CVE-2026-12392CWE-200information-disclosure

CVE-2026-12392

Medium · published October 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00273 · 18.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-10-03T00:17Z
References (6)
https://bugs.launchpad.net/maas/+bug/2153942 · [email protected]https://github.com/canonical/maas/commit/3864ef9dca54e36e3d34d18233b87666b8ee1dc8 · [email protected]https://github.com/canonical/maas/commit/65e89c05970f4514f9e6de043c2779017b43ad9d · [email protected]https://github.com/canonical/maas/commit/8489979d64b0e7f124e7cef66d02b21263918f9b · [email protected]https://github.com/canonical/maas/commit/a9486ad0cc90f4571142c1bea13f02d1361cb31e · [email protected]https://github.com/canonical/maas/commit/ead659f70224538517c80478c3fd8c9e730aae79 · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 19:24Z
    RPC secret disclosure via vendor data endpoint in Canonical MAAS
    cvelistv5