CVE-2026-1237

Improper Verification of Cryptographic Signature (CWE-347)

2026-01-28 security@ubuntu.com

GHSA-j477-6vpg-6c8x

Information Disclosure

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 15:16 nvd

N/A

DescriptionCVE.org

Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.

AnalysisAI

Vulnerable cross-model authorization in juju.

Technical ContextAI

Classified as CWE-347 (Improper Verification of Cryptographic Signature). Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.