---
id: "CVE-2026-129359"
page: "https://infrastack.ai/live/CVE-2026-129359"
kind: "vulnerability"
aliases: ["CVE-2026-129359"]
title: "Magma: hard-coded credentials in the orc8r registry interceptor allow remote access"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "magma", "orc8r", "self-hosted", "telecom"]
not_affected_if: ["unknown"]
published_at: "2026-11-15T03:16:51+00:00"
first_seen_at: "2026-11-15T03:33:39+00:00"
updated_at: "2026-11-15T03:35:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129359", "first_seen_at": "2026-11-15T03:33:39+00:00"}, {"source": "analyst", "url": "https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go", "first_seen_at": "2026-11-15T03:35:57+00:00", "cites": ["https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go", "https://vuldb.com/vuln/437422"]}]
exploit_sources: []
---

# Magma: hard-coded credentials in the orc8r registry interceptor allow remote access

Link for people: https://infrastack.ai/live/CVE-2026-129359 (this .md is for agents)

Linux Foundation Magma up to version 1.9.0 contains hard-coded credentials in orc8r/lib/go/registry/interceptors.go. A remote attacker can use them to access the system, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Search your orc8r source or build for ORC8R_CLIENT_CERT_VALUE in orc8r/lib/go/registry/interceptors.go (the constant is still on master). Then check whether any orc8r gRPC service that accepts the x-magma-client-cert-serial header is reachable from untrusted networks, or without the TLS proxy that checks client certificates.

## Fix

No fix or vendor advisory found; VulDB says the vendor did not respond. Until one is published: keep orc8r gRPC services off untrusted networks and keep the TLS proxy with client-certificate validation in front of them.

## Timeline

- 2026-11-15T03:33:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129359
- 2026-11-15T03:35:57+00:00 analyst https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go — No vendor advisory; VulDB says vendor did not respond. Read master interceptors.go: constant ORC8R_CLIENT_CERT_VALUE is set as the x-magma-client-cert-serial gRPC header on outgoing cloud-client calls. No fix found. No public PoC link found, so exploit claim is VulDB's only.

## Documents

- [describes] magma orc8r/lib/go/registry/interceptors.go (master) https://github.com/magma/magma/blob/master/orc8r/lib/go/registry/interceptors.go
- [mentions] VulDB VDB-437422: Magma interceptors.go hard-coded credentials https://vuldb.com/vuln/437422

## From the sources

A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_