CVE-2026-129360
Deferred Deferred - Pending Action

Authentication Bypass in Linux Foundation Magma via X-Magma-Client-Cert-Serial Spoofing

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulDB

Description
A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129360
EUVD
EUVD-2026-125974

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Linux Foundation Magma up to version 1.9.0. It exists in the Obsidian REST component, specifically in the file orc8r/cloud/go/services/obsidian/access/operator.go. By manipulating the X-Magma-Client-Cert-Serial argument, an attacker can bypass authentication and spoof access remotely.

Detection Guidance

The CVE describes an authentication bypass in Linux Foundation Magma up to 1.9.0 via manipulation of the X-Magma-Client-Cert-Serial header. To detect this, inspect HTTP requests to Magma's Obsidian REST service for unusual or missing client certificate serial numbers in headers. Check logs for requests with this header field altered or absent.

Impact Analysis

This vulnerability allows remote attackers to bypass authentication and gain unauthorized access to the Magma system. This could lead to data breaches, unauthorized modifications, or service disruption depending on the privileges of the spoofed account.

Compliance Impact

This vulnerability allows remote authentication bypass through spoofing of the X-Magma-Client-Cert-Serial argument, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized data exposure or modification.

Mitigation Strategies

Upgrade Magma to a version beyond 1.9.0 if available. If no patch exists, disable the Obsidian REST service or restrict access to the affected file orc8r/cloud/go/services/obsidian/access/operator.go. Monitor network traffic for unusual authentication requests using the X-Magma-Client-Cert-Serial header.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129360. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...