CVE-2026-129357

Linux Foundation Magma Host Middleware middleware.ts hostOrgMiddleware authorization

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Description
A vulnerability was determined in Linux Foundation Magma up to 1.9.0. This issue affects the function hostOrgMiddleware of the file nms/server/host/middleware.ts of the component Host Middleware. This manipulation of the argument role causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The flaw appears in the Host Middleware component of Linux Foundation Magma up to 1.9.0. A mismanaged role argument in the hostOrgMiddleware function causes an essential authorization check to be omitted, permitting a remote caller to perform actions that should be restricted. This missing authorization vulnerability (CWE-862) is compounded by improper access control (CWE-863). The effect is the ability to tamper with or read privileged network management data, potentially impacting confidentiality and integrity of the system.

Affected Systems

Linux Foundation Magma versions 1.9.0 or earlier.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, so the likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been documented. The likely attack vector is remote API interaction, as the flaw can be triggered by sending crafted role parameters to the host organization endpoint. This path requires network access to the NMS API but does not require local presence or special authentication, so the risk to any exposed instance remains significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a Magma release newer than 1.9.0 that contains the authorization fix.
  • Limit network access to the NMS API to trusted hosts or subnets.
  • Apply strict role-based access controls on the host organization endpoint and audit the RBAC configuration to enforce least privilege.

Generated by OpenCVE AI on November 15, 2026 at 04:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linuxfoundation
Linuxfoundation magma
Vendors & Products Linuxfoundation
Linuxfoundation magma
Type Values Removed Values Added
Description A vulnerability was determined in Linux Foundation Magma up to 1.9.0. This issue affects the function hostOrgMiddleware of the file nms/server/host/middleware.ts of the component Host Middleware. This manipulation of the argument role causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Linux Foundation Magma Host Middleware middleware.ts hostOrgMiddleware authorization
First Time appeared Linux Foundation
Linux Foundation magma
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:o:linux_foundation:magma:*:*:*:*:*:*:*:*
Vendors & Products Linux Foundation
Linux Foundation magma
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 2:30 AM
Reserved
Nov 14, 2026, 6:50 AM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 3:16 AM
Modified
Nov 15, 2026, 3:16 AM

View source JSON

No data.

Updated
Nov 15, 2026, 4:15 AM

JSON