CVE-2026-129357 in Magma
Summary
by MITRE • 11/15/2026
A vulnerability was determined in Linux Foundation Magma up to 1.9.0. This issue affects the function hostOrgMiddleware of the file nms/server/host/middleware.ts of the component Host Middleware. This manipulation of the argument role causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/15/2026
The Linux Foundation Magma platform, specifically versions up to 1.9.0, contains a critical security flaw within its Network Management System (NMS) component that allows for unauthorized access through improper authorization checks. The vulnerability resides in the hostOrgMiddleware function located in the nms/server/host/middleware.ts file of the Host Middleware module. This middleware is responsible for validating user permissions and roles before granting access to specific resources or administrative functions within the Magma infrastructure management interface. By manipulating the role argument passed during request processing, an attacker can bypass these security controls entirely. The core technical flaw is a classic case of missing authorization, where the application fails to properly verify that the authenticated user possesses the necessary privileges for the requested action. This oversight allows any remote actor with network access to the NMS interface to escalate their permissions or execute administrative commands without valid credentials.
From an operational perspective, this vulnerability poses a severe risk to the integrity and availability of Magma-based telecommunications networks. Since the Host Middleware interacts directly with host-level configurations and potentially sensitive network management data, successful exploitation could allow attackers to modify system settings, disrupt service continuity, or pivot further into the internal network infrastructure. The fact that the exploit has been publicly disclosed significantly increases the likelihood of automated attacks against exposed instances. Organizations relying on Magma for 5G core deployment or edge computing orchestration must treat this as a high-priority issue due to the direct impact on critical telecommunications operations. The lack of response from the vendor since early contact suggests that immediate remediation may require manual patching or configuration changes rather than waiting for an official update, highlighting the importance of proactive vulnerability management in open-source infrastructure projects.
This flaw aligns with CWE-285 Improper Authorization, which describes scenarios where a software application does not properly verify whether a user has permission to perform a specific action. In the context of the MITRE ATT&CK framework, this vulnerability facilitates lateral movement and privilege escalation techniques by allowing an attacker to bypass access control mechanisms initially deployed in the network. Attackers can leverage this weakness to gain initial foothold or expand their influence within the environment without detection through standard authentication logs. To mitigate this risk, administrators should immediately restrict public internet exposure of the Magma NMS interface if it is not strictly necessary for remote management. Implementing strict IP whitelisting and multi-factor authentication adds layers of defense that can compensate for the underlying code flaw until a patched version is available. Additionally, deploying Web Application Firewalls with rules specifically targeting manipulation of role parameters in middleware functions can help block exploitation attempts from external sources while internal security teams prepare to apply vendor-supplied patches or custom fixes as they become available.