Executive Summary

An unauthenticated attacker can retrieve the RPC secret in plaintext from Canonical MAAS (v3.4.10 and earlier, v3.5.14 and earlier, v3.6.5 and earlier, v3.7.3 and earlier, v3.8.0 and earlier) by querying the vendor data metadata endpoint. If a machine was deployed with the 'register as rack' option, the attacker can infer the system ID and use the preseed/metadata server to leak the secret, exposing sensitive credentials without authentication.

---

Authoritative CVE Metadata - CVSS Base Score: 5.3 (MEDIUM) - Published: 2026-10-02T20:17:01.817 - Last Modified: 2026-10-04T16:16:30.650

Original Description: An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.

"To accomplish great things, we must dream as well as act."

— Anatole France