MAAS

  1. Bug #1507586
  2. Comment #0

Comment 0 for bug 1507586

Revision history for this message
Scott Moser (smoser) wrote : previous occupent of node can use oauth creds to retrieve current owner's user-data

Currently, maas has no separation between 'instance' and 'node'. There is no unique information per "instance".

Thus, if I:
  a.) deploy a node
  b.) read oauth credentials from that node
  c.) return that node

I can read the user-data that the new owner provided . user-data might possibly containing sensitive information.

A secondary fallout of this if a node boots into an old installation maas thinks it was deployed and marks it DEPLOYED.

Related bugs:
 * bug 944325: no separation of instance id from node id