---
id: "CVE-2026-111684"
kind: "vulnerability"
aliases: ["CVE-2026-111684"]
title: "Magistrala: workspace members can view and revoke other tenants' device certificates"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "magistrala", "fixed": [], "affected": "<= 1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["certs", "iot", "magistrala", "mtls", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["certs-service-disabled", "no-mtls", "single-tenant-deployment"]
published_at: "2026-10-16T18:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:45:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111684", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:45:53+00:00"}]
---

# Magistrala: workspace members can view and revoke other tenants' device certificates

Magistrala through 1.0.0 lets an authenticated workspace member act on certificates belonging to other tenants by supplying foreign serials or entity ids. An attacker can disclose certificates, revoke other tenants' devices, and issue CA-signed certificates for their own device ids.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:magistrala affected <= 1.0.0 fixed ?

## How to check

Run certs service from absmach/magistrala <= v1.0.0 (also v0.51.0 and v0.40.0 per reporter) = exposed. Check: with a normal member token of workspace A, GET /A/certs/<serial of a workspace B cert>; a returned certificate means vulnerable. Test on a staging instance only. Review certs service logs for PATCH /<ws>/certs/<serial>/revoke or DELETE /<ws>/certs/<entity>/delete where the serial or entity does not belong to <ws>.

## Fix

No fixed version published as of 2026-10-25. Watch https://github.com/absmach/magistrala/releases for a release after v1.0.0. Interim: if you do not need multi-tenancy, restrict certs routes to trusted users; otherwise block /{workspaceID}/certs at the gateway for non-admin users, and keep copies of issued serials so you can reissue revoked device certs. Fix needs a code and schema change (the cert_entity_mappings table has no workspace column).

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111684
- 2026-10-25T03:45:53+00:00 analyst — No fixed Magistrala release found: v1.0.0 LTS (2026-09-04) is the latest and is affected; vendor has published no advisory or commit. Details from VulnCheck advisory and reporter write-up (hackmd; requests were not executed by the reporter). Nothing verified.

## Documents

- [advisory] VulnCheck: Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service https://www.vulncheck.com/advisories/magistrala-through-1.0.0-cross-tenant-authorization-bypass-in-certs-service
- [describes] Reporter write-up: Magistrala certs service missing workspace scope https://hackmd.io/@hieuPenguinnn/magistrala-certs-missing-workspace-scope-cross-tenant
- [mentions] Magistrala v1.0.0 LTS release (latest, no fix noted) https://github.com/absmach/magistrala/releases/tag/v1.0.0

## From the sources

Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_