Juju CVE-2026-4370

Network access to Juju controller's Dqlite database port (default 19001). Affects Juju versions 3.2.0-3.6.19 and 4.0-4.0.4. No authentication required; unauthenticated remote attacker can join cluster due to missing TLS client certificate validation.

The CVSS 10.0 score accurately reflects critical risk: network attack vector (AV:N) with low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope change (S:C), and complete confidentiality, integrity, and availability impact. Real-world risk is exceptionally high in environments where Juju controllers are exposed to untrusted networks or compromised network segments. Exploitation requires only TCP connectivity to the Dqlite port (typically 17071) and the ability to initiate TLS connections without valid credentials-trivial for adversaries with network positioning. The scope change to 'C' indicates impacts extend beyond the vulnerable component itself: compromising the Juju database exposes secrets for all managed cloud substrates, potentially enabling lateral movement to AWS accounts, Kubernetes clusters, or bare-metal infrastructure managed by the controller. While no public exploit identified at time of analysis and EPSS probability data is unavailable, the attack surface is minimal (single network service, no auth required, low complexity) making this highly automatable once discovered. SSVC assessment suggests immediate action: exploitation status unclear but technical impact is total (database access equals controller compromise), and the vulnerability is automatable given simple network prerequisites. Absence from CISA KEV list may reflect the specialized nature of Juju deployments rather than actual exploitation difficulty. This is a genuine critical-priority issue, not a high-CVSS-but-low-real-risk scenario, particularly for organizations using Juju in production multi-cloud or hybrid cloud architectures where controller compromise cascades to managed infrastructure.

An attacker gains network access to a Juju controller's management network through compromised credentials, VPN exploitation, or cloud misconfigurations exposing internal networks. Using network scanning, the attacker identifies TCP port 17071 (Dqlite default) and initiates a TLS connection to the cluster endpoint. Without presenting valid client certificates-or by presenting self-signed certificates-the attacker successfully joins the Dqlite cluster due to missing certificate validation. Once authenticated as a cluster member, the attacker queries the database to extract stored AWS access keys, Azure service principals, Kubernetes kubeconfigs, SSH private keys for managed machines, and model topology data. Using these credentials, the attacker pivots to managed cloud accounts, deploys cryptocurrency miners across Kubernetes clusters, exfiltrates application data from managed workloads, or establishes persistence by deploying malicious charms. The attacker could also modify database records to manipulate infrastructure provisioning, inject backdoors into deployment configurations, or deny service by corrupting cluster state.