Canonical Maas vulnerabilities

4 CVEs affecting Canonical Maas, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12392, published 2026-10-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-1058, published 2013-11-23. Medium severity, CVSS 5.8. EPSS: 1.9% chance of exploitation in the next 30 days. maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.
CVE-2013-1057, published 2013-11-18. Medium severity, CVSS 4.4. EPSS: 0.6% chance of exploitation in the next 30 days. Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current…
CVE-2026-12392, published 2026-10-02. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the…
CVE-2025-7044, published 2025-12-03. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the…