CVE-2026-129359

Linux Foundation Magma interceptors.go hard-coded credentials

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Description
A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in the Linux Foundation Magma control plane allows an attacker to manipulate an unknown function in the file orc8r/lib/go/registry/interceptors.go, which exposes hard‑coded credentials and permits remote authentication bypass. This credential leakage can enable an attacker to obtain privileged access, read or modify system configuration, and potentially execute arbitrary code. The weakness stems from insecure storage of credentials, corresponding to CWE-259 and CWE-798.

Affected Systems

Linux Foundation Magma versions up to 1.9.0 are affected. The vulnerability resides in the interceptors component of the orc8r library and is present in all releases through 1.9.0. No later revisions have been confirmed to contain the flaw.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The flaw can be triggered remotely without special privileges, and a public exploit has already been released, increasing the likelihood of real‑world attacks. Since it is not listed in the CISA KEV catalog, the risk hinges on an available fix and how quickly users can apply it.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Magma to a version newer than 1.9.0 that removes the hard‑coded credential issue.
  • If an upgrade cannot be performed immediately, disable or remove the vulnerable interceptors component to eliminate the attack path.
  • Configure network segmentation or firewall rules to block unauthenticated or unauthorized remote access to the interceptors functionality.

Generated by OpenCVE AI on November 15, 2026 at 04:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linuxfoundation
Linuxfoundation magma
Vendors & Products Linuxfoundation
Linuxfoundation magma
Type Values Removed Values Added
Description A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Linux Foundation Magma interceptors.go hard-coded credentials
First Time appeared Linux Foundation
Linux Foundation magma
Weaknesses CWE-259
CWE-798
CPEs cpe:2.3:o:linux_foundation:magma:*:*:*:*:*:*:*:*
Vendors & Products Linux Foundation
Linux Foundation magma
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-259

    Use of Hard-coded Password

  • CWE-798

    Use of Hard-coded Credentials

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 3:00 AM
Reserved
Nov 14, 2026, 6:50 AM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 3:16 AM
Modified
Nov 15, 2026, 3:16 AM

View source JSON

No data.

Updated
Nov 15, 2026, 5:15 AM

JSON