Maas
Monthly
Canonical MAAS exposes the region controller's RPC secret in plaintext through the vendor-data metadata endpoint, letting an unauthenticated attacker who can reach that endpoint and knows or guesses a target machine's MAAS system ID recover the shared secret used for rack-controller RPC authentication (CVSS 5.3 / assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Exposure is conditional: it only affects instances where a machine was deployed with the non-default 'register as rack' (install_rackd) option enabled, and it further requires network reachability to the preseed/metadata server plus knowledge of the system ID. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but vendor patches exist in MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0, and the fix disables the vulnerable deploy-as-rack feature entirely.
Privilege escalation in Canonical MAAS allows an authenticated low-privileged user to self-promote to administrator by manipulating a user.update websocket request so that the is_superuser property is set to true. The server fails to validate that the caller is authorized to change that privilege flag, giving the attacker full administrative control over the MAAS deployment. Canonical MAAS 3.3.x, 3.4.x, 3.5.x, and 3.6.x within the affected version ranges are impacted; vendor patches are available, EPSS is low at 0.04%, and no public exploit was identified at time of analysis.
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current. Rated medium severity (CVSS 4.4). Public exploit code available and no vendor patch available.
Canonical MAAS exposes the region controller's RPC secret in plaintext through the vendor-data metadata endpoint, letting an unauthenticated attacker who can reach that endpoint and knows or guesses a target machine's MAAS system ID recover the shared secret used for rack-controller RPC authentication (CVSS 5.3 / assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Exposure is conditional: it only affects instances where a machine was deployed with the non-default 'register as rack' (install_rackd) option enabled, and it further requires network reachability to the preseed/metadata server plus knowledge of the system ID. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but vendor patches exist in MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0, and the fix disables the vulnerable deploy-as-rack feature entirely.
Privilege escalation in Canonical MAAS allows an authenticated low-privileged user to self-promote to administrator by manipulating a user.update websocket request so that the is_superuser property is set to true. The server fails to validate that the caller is authorized to change that privilege flag, giving the attacker full administrative control over the MAAS deployment. Canonical MAAS 3.3.x, 3.4.x, 3.5.x, and 3.6.x within the affected version ranges are impacted; vendor patches are available, EPSS is low at 0.04%, and no public exploit was identified at time of analysis.
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current. Rated medium severity (CVSS 4.4). Public exploit code available and no vendor patch available.