MAGMA · CVE-2026-129360 · Other
NO FIX YET
Magma up to 1.9.0 lets a remote attacker manipulate the X-Magma-Client-Cert-Serial header in the Obsidian REST component. This can spoof an identity and bypass authentication.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Magma Orchestrator (orc8r) up to 1.9.0 with the Obsidian REST API reachable by untrusted clients. The code takes the client certificate serial from a request header and looks it up in Certifier, so it is only safe when a trusted proxy sets that header from the real TLS client certificate. Deployments where the API is reachable only through such a proxy, or only from a private network, are less exposed. The sources do not say whether the attacker needs to know a valid operator serial. No vendor advisory or patch exists yet.
Not affected if auth-required, default-config, private-network
Who cares magma, orc8r, self-hosted, telecom
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.