Platform
linux
Component
maas
Fixed in
3.1.4
3.2.11
3.3.8
3.4.4
3.5.1
CVE-2024-6107 is a critical vulnerability affecting MAAS versions 3.1.0 through 3.5.1. This flaw stems from insufficient verification, enabling a malicious client to bypass authentication checks and execute Remote Procedure Call (RPC) commands within a region. Successful exploitation grants an attacker unauthorized control, potentially leading to significant system compromise. A fix is available in version 3.5.1.
The impact of CVE-2024-6107 is severe. An attacker who successfully exploits this vulnerability can gain complete control over a region within the MAAS environment. This includes the ability to provision, modify, and delete virtual machines and bare metal servers, effectively compromising the entire infrastructure managed by MAAS. The attacker could also potentially leverage this access to move laterally within the network, depending on the configuration and access controls in place. The blast radius extends to all systems managed by the affected MAAS region.
CVE-2024-6107 has been published on 2025-07-21. The EPSS score is likely to be high given the critical CVSS score and the potential for remote, unauthenticated exploitation. Public proof-of-concept code is not currently available, but the vulnerability's nature suggests it could be relatively easy to exploit. Monitor CISA and vendor advisories for further updates and potential exploitation campaigns.
Exploit Status
EPSS
0.10% (28% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-6107 is to upgrade to MAAS version 3.5.1 or later. If immediate upgrade is not feasible, consider implementing stricter network segmentation to limit the potential impact of a successful attack. Review and harden RPC access controls within the MAAS environment. Monitor MAAS logs for suspicious activity, particularly related to RPC calls and authentication attempts. While a direct WAF rule is unlikely, consider rules that restrict access to RPC endpoints from untrusted sources. After upgrading, confirm the fix by attempting to authenticate with a malicious client and verifying that authentication is rejected.
Update MAAS to the corrected version that includes the fix for insufficient verification. This will prevent remote attackers from executing unauthorized RPC commands. See the MAAS release notes for specific details about the update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-6107 is a critical vulnerability in MAAS versions 3.1.0 through 3.5.1 that allows attackers to bypass authentication and execute RPC commands, potentially gaining control of managed regions.
If you are running MAAS versions 3.1.0, 3.2.0, 3.3.0, 3.4.0, or 3.5.0, you are vulnerable to this RPC bypass vulnerability. Check your version immediately.
Upgrade to MAAS version 3.5.1 or later to address this vulnerability. If immediate upgrade is not possible, implement network segmentation and monitor logs.
While no active exploitation has been publicly confirmed, the critical severity and ease of potential exploitation suggest it is a high-priority risk. Monitor for updates.
Refer to the official MAAS security advisories on the Canonical website for detailed information and updates regarding CVE-2024-6107.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.