CVE-2024-6107
Due to insufficient verification, an attacker could use a malicious client to bypass...
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
- Record
CVE-2024-6107- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2024-54803
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
- Record
EUVD-2024-54803- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-525h-hfxr-w785
Due to insufficient verification, an attacker could use a malicious client to bypass...
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
- Record
GHSA-525h-hfxr-w785- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
- Record
CVE-2024-6107- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-6107
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
- Record
UBUNTU-CVE-2024-6107- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
maasUbuntu:16.04:LTS |
All versions, plus listed versions 1.8.3+bzr4053-0ubuntu11.9.0+bzr4533-0ubuntu11.10.0+bzr4578-0ubuntu22.0.0~alpha1+bzr4736-0ubuntu12.0.0~alpha2+bzr4776-0ubuntu1 Show 18 moreShow less2.0.0~alpha3+bzr4810-0ubuntu12.0.0~alpha4+bzr4843-0ubuntu12.0.0~beta1+bzr4873-0ubuntu12.0.0~beta1+bzr4873-0ubuntu22.0.0~beta1+bzr4873-0ubuntu32.0.0~beta2+bzr4920-0ubuntu12.0.0~beta2+bzr4920-0ubuntu22.0.0~beta3+bzr4941-0ubuntu12.0.0~rc2+bzr5156-0ubuntu1~16.04.12.0.0~rc2+bzr5156-0ubuntu1~16.04.22.0.0+bzr5189-0ubuntu1~16.04.12.1.1+bzr5544-0ubuntu1~16.04.12.1.3+bzr5573-0ubuntu1~16.04.12.1.5+bzr5596-0ubuntu1~16.04.12.2.0+bzr6054-0ubuntu2~16.04.12.2.2-6099-g8751f91-0ubuntu1~16.04.12.3.0-6434-gd354690-0ubuntu1~16.04.12.3.5-6511-gf466fdb-0ubuntu1 |
None known |
maasUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.0~beta2-6327-gdd05aa2-0ubuntu12.3.0-6434-gd354690-0ubuntu12.4.0~alpha2-6717-gffaddd526-0ubuntu1~18.04.12.4.0~beta1-6799-g391e5f16d-0ubuntu12.4.0~beta2-6865-gec43e47e6-0ubuntu12.4.0-6981-g011e51b7a-0ubuntu1~18.04.12.4.2-7034-g2f5deb8b8-0ubuntu1 |
None known |
maasUbuntu:20.04:LTS |
All versions, plus listed versions 2.6.0-7802-g59416a869-0ubuntu11:0.11:0.21:0.31:0.41:0.51:0.61:0.7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6107 is a critical vulnerability (CVSS 9.6) in Canonical Maas, published July 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.