{"id":"CVE-2026-129359","kind":"vulnerability","aliases":["CVE-2026-129359"],"related":[],"title":"Magma: hard-coded credentials in the orc8r registry interceptor allow remote access","description":"A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Linux Foundation Magma up to version 1.9.0 contains hard-coded credentials in orc8r/lib/go/registry/interceptors.go. A remote attacker can use them to access the system, and a public exploit exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","magma","orc8r","self-hosted","telecom"],"not_affected_if":["unknown"],"how_to_check":"Search your orc8r source or build for ORC8R_CLIENT_CERT_VALUE in orc8r/lib/go/registry/interceptors.go (the constant is still on master). Then check whether any orc8r gRPC service that accepts the x-magma-client-cert-serial header is reachable from untrusted networks, or without the TLS proxy that checks client certificates.","fix":"No fix or vendor advisory found; VulDB says the vendor did not respond. Until one is published: keep orc8r gRPC services off untrusted networks and keep the TLS proxy with client-certificate validation in front of them.","status":"open","published_at":"2026-11-15T03:16:51+00:00","first_seen_at":"2026-11-15T03:33:39+00:00","triaged_at":"2026-11-15T03:34:46+00:00","updated_at":"2026-11-15T03:35:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-15T03:34:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Magma: hard-coded credentials in the orc8r registry interceptor allow remote access","impact":"high","summary":"Linux Foundation Magma up to version 1.9.0 contains hard-coded credentials in orc8r/lib/go/registry/interceptors.go. A remote attacker can use them to access the system, and a public exploit exists.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["magma","orc8r","telecom","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker gains access using hard-coded credentials","analyst_note":"Find the vendor or project advisory and the fixed version beyond 1.9.0; the sources give no fix or affected configuration detail.","how_to_check":"- Check the installed Magma version against `1.9.0` and look for `orc8r/lib/go/registry/interceptors.go` in the source tree\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running Magma up to version 1.9.0 for mobile core network orchestration (orc8r) are exposed. The sources do not say which deployment configurations are reachable from the internet. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4581,"output_tokens":491,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor or project advisory and the fixed version beyond 1.9.0; the sources give no fix or affected configuration detail.","search":"'-129359':16A,19A '-2026':15A,18A '1.9.0':33B,68C 'access':13A,48B 'affect':70C 'allow':11A 'attack':43B,90C,108C 'code':4A,37B,87C 'contact':112C 'contain':34B 'credenti':5A,38B,88C 'cve':14A,17A 'disclosur':116C 'discov':61C 'earli':113C 'element':71C 'exist':55B 'exploit':54B,96C 'file':78C 'flaw':58C 'foundat':28B,64C 'function':75C 'hard':3A,36B,86C 'hard-cod':2A,35B,85C 'host':25B 'infrastructur':20B 'initi':93C 'interceptor':10A 'linux':27B,63C 'magma':1A,21B,29B,65C 'manipul':82C 'may':104C 'orc8r':8A,22B 'orc8r/lib/go/registry/interceptors.go':40B,79C 'perform':80C 'public':53B,102C 'registri':9A 'releas':99C 'remot':12A,42B,94C 'respond':120C 'result':83C 'secur':57C 'self':24B 'self-host':23B 'system':50B 'telecom':26B 'unknown':74C 'use':45B,106C 'vendor':110C 'version':32B 'way':123C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Magma orchestrator (orc8r) deployments built from source up to 1.9.0. The orc8r client interceptor hard-codes a 'magic' client certificate serial value that is sent in the x-magma-client-cert-serial header to identify internal service clients. Exposure depends on whether an orc8r service that trusts this header can be reached by an outside party, which the sources do not say. Teams that don't run Magma orc8r can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","magma","orc8r","selfhosted","telecom"],"campaign_type":null,"search_a":"'-129359':16A,19A '-2026':15A,18A 'access':13A 'allow':11A 'code':4A 'credenti':5A 'cve':14A,17A 'hard':3A 'hard-cod':2A 'interceptor':10A 'magma':1A 'orc8r':8A 'registri':9A 'remot':12A","search_b":"'1.9.0':33B 'access':48B 'attack':43B 'code':37B 'contain':34B 'credenti':38B 'exist':55B 'exploit':54B 'foundat':28B 'hard':36B 'hard-cod':35B 'host':25B 'infrastructur':20B 'linux':27B 'magma':21B,29B 'orc8r':22B 'orc8r/lib/go/registry/interceptors.go':40B 'public':53B 'remot':42B 'self':24B 'self-host':23B 'system':50B 'telecom':26B 'use':45B 'version':32B","search_c":"'1.9.0':68C 'affect':70C 'attack':90C,108C 'code':87C 'contact':112C 'credenti':88C 'disclosur':116C 'discov':61C 'earli':113C 'element':71C 'exploit':96C 'file':78C 'flaw':58C 'foundat':64C 'function':75C 'hard':86C 'hard-cod':85C 'initi':93C 'linux':63C 'magma':65C 'manipul':82C 'may':104C 'orc8r/lib/go/registry/interceptors.go':79C 'perform':80C 'public':102C 'releas':99C 'remot':94C 'respond':120C 'result':83C 'secur':57C 'unknown':74C 'use':106C 'vendor':110C 'way':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T03:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129359","severity":null,"published_at":"2026-11-15T03:16:51+00:00","modified_at":"2026-11-15T03:16:52+00:00","first_seen_at":"2026-11-15T03:33:39+00:00","fetched_at":"2026-11-15T03:33:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129359:4018","url":"https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go","severity":null,"published_at":"2026-11-15T03:35:57+00:00","modified_at":"2026-11-15T03:35:57+00:00","first_seen_at":"2026-11-15T03:35:57+00:00","fetched_at":"2026-11-15T03:35:57+00:00","note":"No vendor advisory; VulDB says vendor did not respond. Read master interceptors.go: constant ORC8R_CLIENT_CERT_VALUE is set as the x-magma-client-cert-serial gRPC header on outgoing cloud-client calls. No fix found. No public PoC link found, so exploit claim is VulDB's only.","cites":["https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go","https://vuldb.com/vuln/437422"]}],"documents":[{"id":160489,"url":"https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go","title":"magma orc8r/lib/go/registry/interceptors.go (master)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":160490,"url":"https://vuldb.com/vuln/437422","title":"VulDB VDB-437422: Magma interceptors.go hard-coded credentials","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}