CVE-2026-12392

Executive Summary

CVE-2026-12392 is an information exposure vulnerability in Canonical MAAS (Metal as a Service) that allows an unauthenticated attacker to retrieve the RPC secret in plaintext from the vendor data metadata endpoint. All MAAS deployments prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 are affected when a managed machine was deployed with the "register as rack" option enabled. The impact is limited to confidentiality (CVSS 5.3, C:L) but is significant because the leaked RPC secret is a high-value credential that can be abused for lateral movement against the MAAS control plane.

Technical Analysis

MAAS operates a metadata service that is queried by machines during and after provisioning (cloud-init style vendor data / preseed retrieval). When an operator uses the "register as rack" deployment option, the provisioned machine is configured to register itself back to the MAAS environment and is therefore provisioned with the RPC secret material needed to authenticate to the region/rack RPC channel.

The vulnerability is a classic unauthenticated information-exposure flaw (CWE-200). The vendor data metadata endpoint fails to require authentication and fails to withhold sensitive credential material from the response. As a result, the RPC secret is returned in plaintext to any requester who presents the correct machine context — i.e., the target machine's system ID.

Two properties make this exploitable rather than merely a misconfiguration:

1. No authentication on the metadata endpoint. The CVSS vector confirms PR:N and UI:N — no privileges and no user interaction are required.
2. System ID used as a weak selector rather than a secret. Predictable, enumerable, or inferable system IDs undermine any access control that depends on them.

Because the affected component is the metadata/preseed server rather than the RPC service itself, exploitation does not require interacting with the RPC protocol: the attacker only needs HTTP access to the metadata endpoint and a valid system ID. The NVD description does not disclose the exact URL path, parameter names, or code locations, so this analysis deliberately stays at the vulnerability-class level: this is an authentication-absence / over-exposure problem in a metadata API, not a memory-safety or injection flaw.

Exploitation Scenarios

The attack chain below is inferred strictly from the NVD description. No public PoC or exploit code is available (POC_STATUS: None); the chain is derived from the vulnerability class.

1. Reconnaissance / target identification. The attacker identifies a reachable MAAS metadata/preseed server. These are commonly accessible from the provisioning network (PXE/boot VLAN) and, in misconfigured environments, from broader network segments. Shodan-style fingerprinting of MAAS web interfaces (e.g., http.title:"MAAS", port 5240) can identify exposed instances.
2. System ID acquisition. The attacker obtains or infers the system ID of a machine deployed with the "register as rack" option. The description notes the system ID may be obtained or inferred — implying it is not a cryptographically strong secret dependency. Possible vectors include leaked logs, API responses, provisioning traffic, or predictable values; the exact inference method is not specified in the supplied data.
3. Triggering the flaw. The attacker queries the vendor data metadata endpoint while supplying the target system ID. Because the endpoint performs no authentication (PR:N, AC:L), the request succeeds and the response contains the RPC secret in plaintext.
4. Post-exploitation impact. The stolen RPC secret is a credential granting access to MAAS RPC functionality. An attacker holding it can impersonate a rack controller or otherwise authenticate into the MAAS control plane, potentially leading to the ability to manipulate nodes, alter deployment flows, or pivot deeper into the infrastructure. The CVSS S:U scope reflects that the direct impact is confined to the MAAS component, but the confidentiality loss of a control-plane credential can enable broader downstream compromise.

Impact Assessment

Business impact: MAAS is the provisioning backbone for bare-metal fleets (OpenStack, Kubernetes, GPU clusters, HPC). Leakage of the RPC secret undermines the trust boundary of the provisioning control plane. An adversary with the secret may be able to inject or modify provisioning instructions or hijack registering nodes — an attractive foothold for supply-chain-style attacks against infrastructure brought online through MAAS.

Affected systems: Any MAAS deployment prior to 3.4.10 / 3.5.14 / 3.6.5 / 3.7.3 / 3.8.0 where a machine was enrolled with the "register as rack" option. Environments that do not use that option are not exposed via this specific path.

Blast radius / CVSS subscores: CVSS 5.3 = AV:N (remotely reachable metadata endpoint), AC:L (no special conditions), PR:N (unauthenticated), UI:N (no victim interaction), S:U (scope unchanged), and C:L (confidentiality only, rated Low). The Low confidentiality score reflects that a single high-value secret — not bulk data — is exposed, but its sensitivity means real-world risk may exceed the nominal 5.3.

EPSS: Not yet scored by FIRST.org; no exploit-in-the-wild evidence identified. CISA KEV: NO. No public PoC, Nuclei template, or exploit code exists at the time of writing.

Detection Guidance

Sigma Rule

title: Unauthenticated MAAS Vendor Data Metadata Access
id: 8f0e2c1a-3b4d-4e5f-9a6b-1c2d3e4f5a6b
status: experimental
description: Detects unauthenticated or anomalous access to the MAAS vendor data / metadata endpoint that may indicate RPC secret disclosure (CVE-2026-12392)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-12392
author: Valters IT Threat Intelligence
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/metadata'
      - '/vendor-data'
      - '/preseed'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  filter_legit:
    c-ip|contains:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
  condition: selection_path and selection_method and not filter_legit
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate provisioning traffic from the management network
level: medium

YARA Rule

rule CVE_2026_12392_MAAS_RPC_Secret_Leak
{
    meta:
        description = "Detects plaintext RPC secret exposure in MAAS metadata/vendor-data responses (CVE-2026-12392)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-12392"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $rpc1 = "rpc" nocase
        $rpc2 = "rpc_secret" nocase
        $rpc3 = "rpc-secret" nocase
        $sep1 = "=" ascii
        $sep2 = ":" ascii
        $maas = "maas" nocase
        $vendor = "vendor_data" nocase
        $preseed = "preseed" nocase

    condition:
        uint16(0) == 0x0A0D or true
        and (
            (any of ($rpc*))
            and ($maas or $vendor or $preseed)
            and ($sep1 or $sep2)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-12392 MAAS Unauthenticated Metadata RPC Secret Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/metadata"; http.uri; content:"system"; nocase; classtype:attempted-recon; reference:cve,2026-12392; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-12392; sid:20260012392; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and
      http.request.method in ("GET", "POST") and
      (url.path contains "/metadata" or url.path contains "/vendor-data" or url.path contains "/preseed") and
      user.name == null ]

Splunk SPL Query

index=web OR index=network
(sourcetype=access_combined OR sourcetype=suricata)
(uri_path="/metadata" OR uri_path="/vendor-data" OR uri_path="/preseed")
status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src_ips values(uri_query) as queries by uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="maas,web,cve-2026-12392">
  <rule id="100920" level="10">
    <if_sid>31100</if_sid>
    <url>metadata</url>
    <description>CVE-2026-12392: Possible unauthenticated MAAS metadata endpoint access attempting RPC secret disclosure</description>
    <mitre>
      <id>T1552.001</id>
    </mitre>
    <group>pci_dss_10.2.4,pci_dss_10.2.5,</group>
  </rule>
  <rule id="100921" level="10">
    <if_sid>31100</if_sid>
    <url>vendor-data|preseed</url>
    <description>CVE-2026-12392: Possible MAAS vendor-data/preseed metadata request for RPC secret leak</description>
    <mitre>
      <id>T1552.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was identified from any tracked source and no vendor advisory or workaround is available in the supplied data. The versions listed below are the fixed versions named in the NVD description; they should be treated as the upgrade target pending independent verification against the Canonical security tracker.

1. Immediate mitigations

   • Isolate the MAAS metadata/preseed server so it is reachable only from the provisioning network, never from untrusted segments.
   • Restrict access to the metadata/vendor-data endpoints to known provisioning client IP ranges using network ACLs or a reverse-proxy allowlist.
   • Do not deploy machines with the "register as rack" option unless operationally required; this narrows exposure to this specific path.
   • Treat any machine that has ever exposed a system ID on an untrusted network as potentially compromised and rotate the RPC secret.

2. Patch / upgrade steps

   • Upgrade to MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, or 3.8.0 (whichever is on your supported track).
   • After upgrading, verify the metadata endpoint no longer returns the RPC secret in plaintext.
   • Rotate the RPC secret on all region/rack controllers as a precaution, since it may have been disclosed prior to patching.

3. Long-term hardening

   • Adopt a secret-management approach where control-plane credentials are never delivered through provisioning metadata.
   • Ensure metadata endpoints enforce authentication and least-privilege access rather than relying on system IDs, which can be inferred.
   • Monitor metadata endpoint access with the detection rules above for anomalous or unauthenticated requests.

References

• NVD — CVE-2026-12392: https://nvd.nist.gov/vuln/detail/CVE-2026-12392
• Canonical MAAS security advisories: https://ubuntu.com/security/notices (search for MAAS)
• Canonical MAAS documentation (metadata & vendor data services): https://maas.io/docs
• MITRE ATT&CK T1552.001 — Unsecured Credentials: Credentials In Files: https://attack.mitre.org/techniques/T1552/001/
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html

No known threat actor campaigns or exploit-in-the-wild evidence were identified. EPSS has not yet scored this CVE, it is not listed in CISA KEV, and no public PoC, Nuclei template, or exploit code is available as of the time of writing.