CVE-2025-7044: Privilege Escalation in MAAS

The impact of CVE-2025-7044 is significant. Successful exploitation allows an attacker to bypass standard authentication and authorization controls, granting them complete administrative access to the MAAS environment. This includes the ability to manage servers, networks, and users, potentially leading to data breaches, system compromise, and denial of service. An attacker could leverage this privilege escalation to deploy malicious software, steal sensitive data, or completely disrupt the MAAS infrastructure. The ability to self-promote to administrator represents a severe security risk, particularly in environments where MAAS is used to manage critical infrastructure.

1. Reserved2025-07-03
2. Published2025-12-03
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-7044 is to upgrade to MAAS version 3.8.1 or later, which contains the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the user websocket handler or implementing stricter input validation on the server-side. Monitor MAAS logs for suspicious activity related to user updates and websocket requests. After upgrading, confirm the fix by attempting to update a user's role via the websocket interface and verifying that the is_superuser property cannot be modified without proper authentication.