CVE-2026-129360 | Linux Foundation Magma up to 1.9.0 Obsidian REST operator.go X-Magma-Client-Cert-Serial authentication spoofing

A vulnerability was found in Linux Foundation Magma up to 1.9.0. It has been declared as critical. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of the argument X-Magma-Client-Cert-Serial can lead to authentication bypass by spoofing.

This vulnerability is tracked as CVE-2026-129360. The attack can be launched remotely. No exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More