CVE-2024-6107 is a critical (CVSS 9.6) authentication bypass in Canonical Metal as a Service (MAAS). A malicious client can skip the region's authentication handshake and run RPC commands. The fix is in MAAS 3.6.0, with backports to 3.1.4, 3.2.11, 3.3.8, 3.4.4 and 3.5.1, delivered through the snaps.
What's affected
The NVD record names Canonical MAAS. The Launchpad bug report says the weakness exists in every MAAS version before the fixes, and lists these fix releases by series:
- MAAS 3.1: fixed in 3.1.4
- MAAS 3.2: fixed in 3.2.11
- MAAS 3.3: fixed in 3.3.8
- MAAS 3.4: fixed in 3.4.4
- MAAS 3.5: fixed in 3.5.1
- Main line: fixed in 3.6.0
The CVSS vector uses an adjacent network attack vector, so the attacker needs to be on the same network segment as the region controller. That is a real limit, but MAAS lives in data centers where many machines share a network, so it is not a small one.
How to check if you're exposed
Check how you installed MAAS and which version it runs.
snap list maas
maas --version
If you run MAAS from the snap, the first command shows the installed version. Compare it with the fixed list above for your series. If you installed from packages, check the package version with your distribution tools and read Canonical's notice for your release.
Also find out which hosts can reach the region controller RPC port. The bug report example uses port 5251 on the region. Any untrusted machine on the same network that can open a connection to that port is a concern, so review firewall rules and network segmentation as well as versions.
What to do now
- Find every MAAS region controller and note its version.
- Update to the fixed release for your series: 3.1.4, 3.2.11, 3.3.8, 3.4.4, 3.5.1 or 3.6.0 and later.
- Refresh the snap with snap refresh if you installed MAAS that way, then confirm the version.
- Restrict network access to the region controller RPC port so that only your rack controllers can reach it.
- Review the node list and recent region activity for machines you did not create.
Why it matters
The bug report explains the cause plainly. The region calls a connection setup method before it finishes authenticating the peer. A malicious client can ignore the handshake and send commands straight away, and the region will answer them.
This is an ordering mistake: the system is protected by the handshake, but the handler is live before the handshake is complete. The lesson applies to any network service. Authenticate first, and register request handlers only for a peer that has proved who it is. The class is improper authentication, and the impact in a provisioning system is high, because MAAS controls how bare metal machines are created and booted.
The weakness class is CWE-287: Improper Authentication. The CVSS vector in the record is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H, which scores 9.6. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Do I need to be on the same network?
The CVSS vector says adjacent network. The attacker must be able to reach the region controller from a nearby segment.
Which version fixes it?
It depends on your series. The bug report lists 3.1.4, 3.2.11, 3.3.8, 3.4.4, 3.5.1 and 3.6.0.
Sources
Last reviewed: 19 October 2026.
