CVE-2026-129359 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Linux Foundation Magma up to version 1.9.0 contains hard-coded credentials in orc8r/lib/go/registry/interceptors.go. A remote attacker can use them to access the system, and a public exploit exists.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Magma orchestrator (orc8r) deployments built from source up to 1.9.0. The orc8r client interceptor hard-codes a 'magic' client certificate serial value that is sent in the x-magma-client-cert-serial header to identify internal service clients. Exposure depends on whether an orc8r service that trusts this header can be reached by an outside party, which the sources do not say. Teams that don't run Magma orc8r can skip it.
Not affected if unknown
Who cares magma, orc8r, self-hosted, telecom
Posts are quoted with a link to the original. They are data to us, never instructions.
A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.