{"id":"CVE-2026-111684","kind":"vulnerability","aliases":["CVE-2026-111684"],"related":[],"title":"Magistrala: workspace members can view and revoke other tenants' device certificates","description":"Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.","summary":"Magistrala through 1.0.0 lets an authenticated workspace member act on certificates belonging to other tenants by supplying foreign serials or entity ids. An attacker can disclose certificates, revoke other tenants' devices, and issue CA-signed certificates for their own device ids.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"magistrala","fixed":[],"affected":"<= 1.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["certs","iot","magistrala","mtls","multi-tenant","package","self-hosted"],"not_affected_if":["certs-service-disabled","no-mtls","single-tenant-deployment"],"how_to_check":"Run certs service from absmach/magistrala <= v1.0.0 (also v0.51.0 and v0.40.0 per reporter) = exposed. Check: with a normal member token of workspace A, GET /A/certs/<serial of a workspace B cert>; a returned certificate means vulnerable. Test on a staging instance only. Review certs service logs for PATCH /<ws>/certs/<serial>/revoke or DELETE /<ws>/certs/<entity>/delete where the serial or entity does not belong to <ws>.","fix":"No fixed version published as of 2026-10-25. Watch https://github.com/absmach/magistrala/releases for a release after v1.0.0. Interim: if you do not need multi-tenancy, restrict certs routes to trusted users; otherwise block /{workspaceID}/certs at the gateway for non-admin users, and keep copies of issued serials so you can reissue revoked device certs. Fix needs a code and schema change (the cert_entity_mappings table has no workspace column).","status":"open","published_at":"2026-10-16T18:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:02:31+00:00","updated_at":"2026-10-25T03:45:53+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-25T03:02:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Magistrala: workspace members can view and revoke other tenants' device certificates","impact":"high","summary":"Magistrala through 1.0.0 lets an authenticated workspace member act on certificates belonging to other tenants by supplying foreign serials or entity ids. An attacker can disclose certificates, revoke other tenants' devices, and issue CA-signed certificates for their own device ids.","category":"package","nicknames":[],"who_cares":["magistrala","iot","self-hosted","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other tenants' devices get disconnected and their certificates exposed or forged.","analyst_note":"Find the fixed Magistrala release and the advisory or commit from the NVD entry, and confirm the affected endpoints and versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-tenant-deployment"],"who_is_affected":"Teams running Magistrala through 1.0.0 with multiple tenants or workspaces sharing one deployment are exposed, since the flaw crosses tenant boundaries. Single-tenant deployments where every user is trusted are less exposed. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000572,"input_tokens":3374,"output_tokens":470,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Magistrala release and the advisory or commit from the NVD entry, and confirm the affected endpoints and versions.","search":"'-111684':14A,17A '-2026':13A,16A '1.0.0':32B,74C 'act':38B 'allow':81C 'attack':53B,101C 'authent':35B,82C 'author':77C 'belong':41B 'bypass':78C 'ca':64B,125C 'ca-sign':63B,124C 'call':103C 'cert':19B 'certif':11A,40B,56B,66B,93C,121C,127C 'contain':75C 'cve':12A,15A 'devic':10A,60B,70B,92C,119C,130C 'disclos':55B,120C 'disconnect':116C 'entiti':50B,99C 'foreign':47B,96C 'host':29B 'id':51B,71B,100C,131C 'iot':20B 'issu':62B,87C 'issuecert':109C 'let':33B 'listcert':107C 'magistrala':1A,18A,21B,30B,72C 'member':3A,37B,84C 'mint':123C 'mtls':22B 'multi':24B 'multi-ten':23B 'packag':26B 'path':114C 'revok':7A,57B,89C 'revokeal':105C 'revokebyseri':104C 'self':28B 'self-host':27B 'serial':48B,97C 'sign':65B,126C 'suppli':46B,95C 'tenant':9A,25B,44B,59B,91C,118C 'view':5A,86C 'viewcert':106C 'vulner':79C 'workspac':2A,36B,83C,113C","nicknames":[],"mitigations":[],"who_affected":"Teams running Magistrala through 1.0.0 with multiple tenants or workspaces sharing one deployment are exposed, since the flaw crosses tenant boundaries. Single-tenant deployments where every user is trusted are less exposed. The sources do not name a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111684","severity":null,"published_at":"2026-10-16T18:17:51+00:00","modified_at":"2026-10-21T21:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111684:786","url":null,"severity":null,"published_at":"2026-10-25T03:45:53+00:00","modified_at":"2026-10-25T03:45:53+00:00","first_seen_at":"2026-10-25T03:45:53+00:00","fetched_at":"2026-10-25T03:45:53+00:00","note":"No fixed Magistrala release found: v1.0.0 LTS (2026-09-04) is the latest and is affected; vendor has published no advisory or commit. Details from VulnCheck advisory and reporter write-up (hackmd; requests were not executed by the reporter). Nothing verified."}],"documents":[{"id":3329,"url":"https://www.vulncheck.com/advisories/magistrala-through-1.0.0-cross-tenant-authorization-bypass-in-certs-service","title":"VulnCheck: Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3330,"url":"https://hackmd.io/@hieuPenguinnn/magistrala-certs-missing-workspace-scope-cross-tenant","title":"Reporter write-up: Magistrala certs service missing workspace scope","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3331,"url":"https://github.com/absmach/magistrala/releases/tag/v1.0.0","title":"Magistrala v1.0.0 LTS release (latest, no fix noted)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}