EUVD-2026-21364
GHSA-w5fq-8965-c969
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Juju user
-
ExploitCall CloudSpec API method on Controller facade
-
ExecutionExtract bootstrap cloud credentials
-
ImpactAccess sensitive authentication material
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user access to Juju Controller versions prior to 2.9.57 or 3.6.21. Attacker must have valid credentials to access the Controller facade and call the CloudSpec API method. No victim interaction required. Remote network access to Juju Controller endpoint. |
| Impact | Critical priority for Juju deployments. CVSS 9.9 reflects unauthenticated-equivalent impact: low-privileged users extract bootstrap cloud credentials, enabling lateral movement and infrastructure takeover. Patch available. Organizations running affected versions (2.9.0-2.9.56, 3.6.0-3.6.20) should prioritize immediate upgrade to prevent credential compromise. |
| Exploit ScenarioDerived | Authenticated user with standard Juju role calls CloudSpec API method on Controller facade to retrieve stored bootstrap cloud credentials. No user interaction required. Attacker gains cloud provider access tokens, enabling subsequent infrastructure compromise or lateral movement across cloud resources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Authorization bypass in Canonical Juju Controller facade allows authenticated users to extract bootstrap cloud credentials via CloudSpec API. Affects Juju 2.9.0-2.9.56 and 3.6.0-3.6.20. Low-privileged authenticated attackers can escalate privileges by accessing sensitive cloud provider credentials, enabling lateral movement to infrastructure resources. Network-accessible with low complexity (CVSS 9.9 Critical). No public exploit identified at time of analysis. Patch available in versions 2.9.57 and 3.6.21.
RemediationAI
Vendor-released patch: Juju 2.9.57 (for 2.9.x branch) and 3.6.21 (for 3.6.x branch). Upgrade immediately via standard package management or download from official Canonical repositories. Patches available at https://github.com/juju/juju/pull/22206 and https://github.com/juju/juju/pull/22205. Interim mitigation: restrict network access to Juju controller API endpoints via firewall rules limiting connections to trusted administrative hosts only. Audit existing user permissions; revoke low-privilege accounts with controller access. Review cloud provider audit logs for unauthorized credential usage. Full advisory: https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-285 improper authorization flaw in Controller facade's CloudSpec method permits authenticated users (CVSS PR:L) to bypass privilege checks and retrieve controller bootstrap credentials. Network-vector (AV:N), cross-scope impact (S:C) enables cloud infrastructure compromise beyond Juju itself. Root cause: missing authorization enforcement on sensitive credential-retrieval API.
Know when Juju gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
Executive ViewAI
Canonical Juju Controller contains a critical authorization bypass (CVE-2026-5412, CVSS 9.9) that allows authenticated users to extract cloud provider credentials from the CloudSpec API, directly exposing infrastructure access keys and enabling lateral movement to cloud resources. Organizations running affected Juju versions (2.9.0-2.9.56 or 3.6.0-3.6.20) face immediate risk of credential compromise and unauthorized cloud infrastructure access. This vulnerability requires urgent patching to prevent attackers from leveraging stolen credentials for persistent access to underlying cloud platforms.
Vendor-released patch: Juju 2.9.57 (for 2.9.x branch) and 3.6.21 (for 3.6.x branch). Interim mitigation pending patch deployment: restrict network access to Juju Controller API endpoints; implement role-based access controls to limit CloudSpec API access to only required service accounts; enable API audit logging and monitor for abnormal CloudSpec queries; rotate cloud provider credentials immediately and monitor for unauthorized use.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate pe
In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent bina
The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on t
JUJU_CONTEXT_ID is a predictable authentication secret. Rated high severity (CVSS 8.0), this vulnerability is low attack
The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access deb
Unauthenticated remote database cluster compromise in Canonical Juju (versions 3.2.0-3.6.19 and 4.0-4.0.4) allows comple
An authorization bypass vulnerability in Canonical's Juju versions 3.0.0 through 3.6.18 allows authenticated users with
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged
An authorization bypass vulnerability exists in the Vault secrets back-end implementation of Canonical's Juju orchestrat
Unauthorized resource modification in Juju application orchestration engine allows any authenticated controller user to
Juju application orchestration engine versions 2.9 to 2.9.55 and 3.6 to 3.6.18 allow a compromised workload machine to r
A predictable secret identifier (XID) vulnerability in Juju versions 3.0.0 through 3.6.18 allows a malicious grantee to
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB