CVE-2024-6107

State: Published
Severity: 9.6 Critical
Published: Jul 21, 2025
Updated: Jul 21, 2025
Reserved: Jun 18, 2024

Description

Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.

Scores

CVSS	Score	Vector	Source
3.1	9.6 Critical	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H	canonical

Weaknesses

CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Products

Product	Versions
MAASCanonical	3.1.0 to before 3.1.4Affected 3.2.0 to before 3.2.11Affected 3.3.0 to before 3.3.8Affected 3.4.0 to before 3.4.4Affected 3.5.0 to before 3.5.1Affected

References

https://bugs.launchpad.net/maas/+bug/2069094

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.