| Description | ================================================================================
REPORT ID : MAGMA-2026-005
TITLE : Magma NMS -> Orc8r full compromise chain, and disclosure record
VENDOR : Magma (Linux Foundation)
PRODUCTS : Magma NMS (magmalte), Magma Orc8r (controller/obsidian)
VERSION : master @ 76d9dc0ebc (Magma 1.8.0-era)
REPORTER : Aymen Benlamari (GitHub: aymencdm)
EMBARGO : 2026-11-09
================================================================================
0. SCOPE
Umbrella report for four independent entries; not a fifth vulnerability and
no CVE request. It maps the entries, describes the chain, gives the scores,
and records coordination.
1. ENTRY MAP
MAGMA-2026-001 (#1043997) Host Routes RBAC Bypass (NMS)
MAGMA-2026-002 (#1044004) Stored XSS via Organization Name (NMS)
MAGMA-2026-003 (#1044005) Hardcoded gRPC Client-Cert Token (Orc8r)
MAGMA-2026-004 (#1044006) Certificate Spoofing via HTTP Header (Orc8r)
2. CHAIN
Start: one valid NMS role=0 USER account in the host organization. No
SUPERUSER, client certificate, Orc8r account or internal network position.
Step 1 - 001 (#1043997), CWE-862
POST /host/organization/async/<target>/add_user with "role":3.
hostOrgMiddleware checks only organization.isHostOrg, never req.user.role.
Result: role=3 SUPERUSER in the target organization; the attacker logs in.
Step 2 - 003 (#1044005), CWE-798
From a position that can reach the Orc8r internal gRPC ports, send
x-magma-client-cert-serial: 7ZZXAF7CAETF241KL22B8YRR7B5UF401.
The value is a compile-time constant shared by every deployment. It is
accepted by certifier, accessd, configurator and state. certifier.GetAll
dumps every operator serial, including admin_operator.
Step 3 - 004 (#1044006), CWE-290
Obsidian derives operator identity from the client-supplied
X-Magma-Client-Cert-Serial header without verifying mTLS termination.
Send the admin_operator serial to /magma/v1/networks and the API
authenticates the request as that operator, with full read/write access.
Result: full Orc8r control-plane compromise - networks, tiers, gateways,
ACLs, gateway commands and access to the Orc8r mTLS material.
A SUPERUSER already reaches Orc8r via the NMS mTLS proxy; Steps 2-3 add a
direct, persistent path from any internal foothold without Step 1. Hence
separate entries.
3. EVIDENCE
Phase 1: [email protected] (role=0, host org) POSTed add_user with "role":3;
HTTP 200, user object with "role":3. The new account logged in and listed
all users in the target organization.
Phase 2: grpcurl against controller:9186 with the token returned the
certificate map containing "operator":"admin_operator"; accessd:9191
ListOperators succeeded with the same token.
Phase 3: curl with the admin_operator serial on :9081 returned HTTP 200 for
GET /magma/v1/networks and HTTP 201 for POST /magma/v1/networks.
XSS (002): an org name containing
xss-</script><script>alert(document.cookie)</script>
was stored verbatim and rendered unescaped on /nms for every member.
4. CHAIN CVSS 3.1 - 9.9 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Metric Value Why
AV N HTTP request to the NMS from the network.
AC L Deterministic sequence; no race, timing or memory grooming.
PR L One role=0 account in the host organization.
UI N No victim interaction at any step.
S C Escalation crosses from NMS user authority into Orc8r.
C H Users, networks, subscriber data, serials, ACLs, state.
I H Users, networks, ACLs, entities and gateway config.
A H Users, networks and services can be deleted or disrupted.
5. CHAIN CVSS 4.0 - 9.4 CRITICAL
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Metric Value Why
AV N Network start (NMS HTTP).
AC L Deterministic sequence; no special conditions.
AT N No attack requirements beyond the low-privilege account.
PR L Role=0 NMS account.
UI N No user interaction.
VC H Full read of NMS and Orc8r data.
VI H Full write across both.
VA H Resources and services can be disrupted in both.
SC H Orc8r is a subsequent system with its own authority.
SI H Orc8r configuration can be modified.
SA H Orc8r services and gateways can be disrupted.
Why not 10.0: CVSS 4.0 requires PR:N for 10.0 with all-high impacts. The
chain starts with a low-privilege account, so PR is L and the score is 9.4.
The 3.1 score is 9.9 because S:C captures the scope change.
6. DISCLOSURE AND MAINTAINER DISCUSSION
6.1 Timeline
2026-09-10 Reported to [email protected] after no response from
[email protected], the address named in SECURITY.md.
Jordan Vrtanoski acknowledged the same day.
2026-09-10 Reporter split the report into three root causes (RBAC, gRPC
token, cert header) and supplied PoC evidence.
2026-09-16 Jordan reported that Conrado Gobato and Fernando Francisco were
reproducing and validating the findings, and suggested the
reporter open the advisories. Reporter opened GHSA-c35w-v4hx-v834,
GHSA-vwm9-4rf4-xfwx and GHSA-3227-q56x-v5gp (all private).
2026-10-03 Reporter confirmed the XSS live in a browser and supplied the
full report and PoC evidence.
2026-10-06 Conrado recommended a separate advisory for the XSS citing the
RBAC chain; reporter opened GHSA-cww9-5hqf-996q (private).
2026-10-14 Jordan reported that he could not see any advisories. The
publisher list showed only the "magma owners" team and @tmdzk;
Jordan, Conrado, Fernando and Alexandre are not on it, so they
cannot accept the advisories or request CVEs.
2026-10-16 Reporter contacted the public People-page contacts. Scott Moeller
replied that he is a member, not an owner, and no longer involved
in administration. A Linux Foundation program manager confirmed
that Magma is in maintenance mode with no active workers and
suggested a contact at Meta who is not involved with Magma.
2026-10-19 With no reachable repository admin, the reporter filed this
package with VulDB (CNA) under embargo.
6.2 Governance blocker
GitHub private advisories on a repository can only be accepted, published,
and used to request a CVE by users with repository admin/owner permission.
The publisher list for magma/magma contains only the "magma owners" team and
@tmdzk. The engineers who reproduced and validated the findings (Conrado
Gobato, Fernando Francisco, Alexandre Loureiro, Gabriel Ramos) are not on the
list. Jordan Vrtanoski could not see the advisories at all. Scott Moeller is
a member, not an owner. The Linux Foundation confirms the project is in
maintenance mode with no active workers.
Consequences: the four advisories remain in Triage; no CVE can be requested
through GitHub; the Connect 5G engineers cannot be added as collaborators by
the reporter, who is not an organization owner. The reporter has held public
disclosure since 2026-09-10.
6.3 Why VulDB
Magma has no CNA; the CVE CNA list contains neither Magma nor the Linux
Foundation as a CNA for this project. VulDB is a CNA and covers
vulnerabilities reported to it that are not in another CNA's scope. VulDB
can reserve a CVE before publishing, preserving the embargo.
6.4 Status
Advisories: in Triage, inaccessible to the maintainers who validated the
findings. No public advisory, CVE, or release is associated with these
findings. Public disclosure: none.
7. REFERENCES
MAGMA-2026-001 (#1043997) Host Routes RBAC Bypass
MAGMA-2026-002 (#1044004) Stored XSS via Organization Name
MAGMA-2026-003 (#1044005) Hardcoded gRPC Client-Certificate Token
MAGMA-2026-004 (#1044006) Client Certificate Spoofing via HTTP Header
https://github.com/magma/magma
https://github.com/magma/magma/blob/master/SECURITY.md
Private GHSAs (Triage, not public references):
GHSA-c35w-v4hx-v834 GHSA-cww9-5hqf-996q
GHSA-vwm9-4rf4-xfwx GHSA-3227-q56x-v5gp
8. AUTHORIZATION
All testing was performed against local Docker lab instances built from the
public Magma source tree. The chain creates a network and a user as evidence;
use a disposable environment. Do not run any proof of concept against a system
you do not own or have explicit written authorization to test.
The hardcoded token is a public source constant, identical across deployments.
No real credentials, cookies, private keys or production data are included.
================================================================================
|
|---|