Canonical MAAS EUVD-2026-91775

Exploitable only against MAAS machines deployed with the non-default 'register as rack' (install_rackd) option enabled; the attacker must also obtain or infer the target machine's MAAS system ID and have network access to the preseed/metadata (vendor-data) endpoint. No authentication is required (PR:N). Limiting factors that reduce real-world exposure: the register-as-rack deployment mode is not the default, the system ID must be known or guessed, and the metadata server must be network-reachable to the attacker. Note the patch removes the install_rackd/deploy-as-rack feature entirely, so upgraded instances cannot be newly placed in the vulnerable configuration.

This is a genuine but conditional, moderate-severity issue rather than an urgent widespread threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N, base 5.3) indicates a network-reachable, unauthenticated information leak with no integrity or availability impact, which aligns with the description of an RPC secret exposed via the vendor-data metadata endpoint. No EPSS score, CISA KEV listing, or public exploit was provided in the input, so there is no evidence of active or probable-imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is materially constrained by two preconditions not captured by the CVSS base score: the target machine must have been deployed with the non-default 'register as rack' (install_rackd) option, and the attacker must obtain or infer the machine's system ID before querying the preseed/metadata server. One important nuance to verify: although the base impact is rated C:L, the leaked artifact is the MAAS RPC secret - a credential that governs rack-to-region controller communication - so the downstream consequence (potential rack controller impersonation/privileged access within the MAAS fabric) may be more serious than a 'Low' confidentiality rating suggests; defenders should treat the leaked secret as a compromised credential and rotate it. Overall: a real priority for MAAS operators who used register-as-rack, but low urgency for the broader population given the niche product, missing exploitation signals, and configuration dependency.

An attacker with network reach to a MAAS region/metadata (preseed) server targets a machine that was deployed using the 'register as rack' option. After obtaining or guessing the machine's system ID, the attacker sends an unauthenticated request to the vendor-data metadata endpoint and receives the MAAS RPC secret in plaintext, which can then be abused to impersonate a rack controller. No public proof-of-concept was identified in the provided intelligence.