CVE-2026-129360

Linux Foundation Magma Obsidian REST operator.go authentication spoofing

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Description
A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A weakness in the Obsidian REST component of Linux Foundation Magma allows an attacker to manipulate the X‑Magma‑Client‑Cert‑Serial header, leading to authentication bypass. The flaw exists in an unidentified function in operator.go and can be exploited remotely, permitting unauthorized impersonation of legitimate clients and access to restricted resources.

Affected Systems

Linux Foundation Magma versions up to 1.9.0 are affected, specifically within the Obsidian REST service that processes the X‑Magma‑Client‑Cert‑Serial header during authentication.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, the attack vector is remote via HTTP header manipulation, EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower current exploitation probability but still requiring vigilance.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest available update for Linux Foundation Magma, version 1.9.0 or later, once it is released.
  • Restrict REST API access to trusted internal hosts by configuring firewalls or ACLs.
  • Enforce strict client certificate validation and disable reliance on the X‑Magma‑Client‑Cert‑Serial header for authentication; reject requests with spoofed or missing client certificate headers.
  • Monitor REST API logs for unauthorized access attempts and review access controls regularly.

Generated by OpenCVE AI on November 15, 2026 at 04:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linuxfoundation
Linuxfoundation magma
Vendors & Products Linuxfoundation
Linuxfoundation magma
Type Values Removed Values Added
Description A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title Linux Foundation Magma Obsidian REST operator.go authentication spoofing
First Time appeared Linux Foundation
Linux Foundation magma
Weaknesses CWE-287
CWE-290
CPEs cpe:2.3:o:linux_foundation:magma:*:*:*:*:*:*:*:*
Vendors & Products Linux Foundation
Linux Foundation magma
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-290

    Authentication Bypass by Spoofing

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 3:15 AM
Reserved
Nov 14, 2026, 6:50 AM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 4:16 AM
Modified
Nov 15, 2026, 4:16 AM

View source JSON

No data.

Updated
Nov 15, 2026, 4:45 AM

JSON