Hard-Coded Credentials Vulnerability in Linux Foundation Magma
CVE-2026-129359

6.9MEDIUM

Key Information:

Vendor

Linux
Status
Magma
Vendor
CVE Published:
15 November 2026

What is CVE-2026-129359?

A security flaw in Linux Foundation Magma, impacting all versions up to 1.9.0, has been identified in the file orc8r/lib/go/registry/interceptors.go. This vulnerability allows for the exploitation of hard-coded credentials that can be manipulated remotely. The issue was disclosed publicly, and despite notifying the vendor, no response was received. The flaw presents a significant risk as it can be leveraged for unauthorized access and attacks on systems utilizing the affected versions.

Affected Version(s)

Magma 1.0

Magma 1.1

Magma 1.2

References

https://vuldb.com/vuln/437422
vdb-entry
https://vuldb.com/vuln/437422/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129359
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

aymencdm (VulDB User)
VulDB CNA Team
.