CVE-2026-129357 · Infrastructure
NO FIX YET
Linux Foundation Magma up to 1.9.0 has a missing authorization flaw in the hostOrgMiddleware function of its host middleware, where the role argument is manipulated. A remote attacker can start the attack over the network, and a public exploit has been disclosed.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Magma up to version 1.9.0, the open-source mobile core network platform, especially its NMS server exposed beyond trusted networks. Deployments not running Magma or running a newer version are not listed as affected. The sources do not say whether a patched version exists, and the vendor did not respond to early disclosure.
Not affected if newer-version, not-magma
Who cares magma, nms, self-hosted, telecom
1.9.0; versions up to and including it are listed as affected.nms/server/host/middleware.ts is reachable from untrusted networks.No fix yet, per the sources.
A vulnerability was determined in Linux Foundation Magma up to 1.9.0. This issue affects the function hostOrgMiddleware of the file nms/server/host/middleware.ts of the component Host Middleware. This manipulation of the argument role causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.