CVE-2025-7044 Overview
CVE-2025-7044 is an improper input validation vulnerability in Canonical Metal as a Service (MAAS). The flaw resides in the user.update WebSocket handler, which fails to filter privileged properties supplied by clients. An authenticated but unprivileged attacker can inject the is_superuser property into an intercepted WebSocket request and set its value to true. The MAAS server accepts the modified payload and promotes the requesting account to administrator. Successful exploitation grants full administrative control over the MAAS deployment, including bare-metal provisioning, node lifecycle management, and infrastructure configuration.
Critical Impact
Any authenticated MAAS user can self-promote to superuser, taking full administrative control over the affected deployment and its managed infrastructure.
Affected Products
- Canonical MAAS (Metal as a Service)
- MAAS deployments exposing the user WebSocket API
- MAAS installations with unprivileged user accounts provisioned
Discovery Timeline
- 2025-12-03 - CVE-2025-7044 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-7044
Vulnerability Analysis
MAAS exposes a WebSocket API used by the web UI to manage users, machines, and infrastructure state. The user.update handler processes updates to user account attributes such as email address and full name. The handler does not restrict which fields an authenticated caller may modify. When the JSON payload includes the is_superuser boolean, the server persists that value directly to the database. This is a privilege management flaw classified under [CWE-269].
The issue is a business-logic and access-control failure rather than a memory-safety bug. The API implicitly trusts the client-supplied field set, treating self-update requests as safe. There is no server-side authorization check that verifies whether the requesting user is permitted to modify administrative fields on their own account.
Root Cause
The root cause is missing property-level authorization in the user.update WebSocket handler. The handler accepts a dictionary of user attributes and applies them without filtering out fields that should require superuser context. Because MAAS relies on the front-end to omit administrative controls for regular users, tampering with the WebSocket payload bypasses the intended access model.
Attack Vector
An authenticated attacker with any valid MAAS account authenticates to the web UI and opens the standard user profile update flow. Using a browser developer console or an intercepting proxy, the attacker modifies the outgoing user.update WebSocket frame to include is_superuser: true. The server accepts the update and grants administrator privileges. The attacker then reconnects with full superuser rights and can manage nodes, enlist or release hardware, alter DHCP and DNS settings, and pivot into managed infrastructure.
No verified public exploit code is available. Technical details are tracked in the Launchpad Bug Report #2115714.
Detection Methods for CVE-2025-7044
Indicators of Compromise
- Unexpected transitions of user accounts from regular to superuser status in the MAAS user table.
- user.update WebSocket requests containing the is_superuser field originating from non-administrator sessions.
- New administrative actions (node commissioning, credential rotation, DHCP or DNS changes) performed by accounts not previously assigned admin roles.
Detection Strategies
- Audit the MAAS database for accounts where is_superuser = true and correlate against the sanctioned administrator roster.
- Enable and review MAAS audit logs for user.update events that modify privilege-related fields.
- Inspect reverse proxy or load balancer logs for WebSocket traffic containing is_superuser outside of admin-initiated sessions.
Monitoring Recommendations
- Forward MAAS application and audit logs to a centralized SIEM and alert on privilege elevation events.
- Baseline the set of superuser accounts and generate alerts on any addition or modification.
- Monitor authentication events for newly promoted accounts logging in and performing administrative API calls shortly after promotion.
How to Mitigate CVE-2025-7044
Immediate Actions Required
- Apply the latest MAAS security update from Canonical as soon as it is available for your channel (snap, deb, or Charmed MAAS).
- Enumerate all accounts where is_superuser is set to true and revoke unauthorized privileges.
- Rotate API keys and session tokens for any account that was improperly elevated.
- Restrict network access to the MAAS WebSocket endpoint to trusted administrative networks.
Patch Information
Refer to the Launchpad Bug Report #2115714 for fix status and supported release channels. Canonical addresses the flaw by enforcing server-side authorization on the user.update handler so that only superusers may modify the is_superuser field.
Workarounds
- Limit MAAS account creation to trusted operators until patched builds are deployed.
- Place the MAAS UI and API behind an authenticating reverse proxy that restricts access to administrative IP ranges.
- Enable and continuously review MAAS audit logging so that unauthorized privilege changes are detected quickly.
# Identify all superuser accounts in a MAAS deployment for review
sudo maas $PROFILE users read | jq '.[] | select(.is_superuser==true) | .username'
# Revoke superuser status from an unauthorized account
sudo maas $PROFILE user update $USERNAME is_superuser=false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
