CVE-2026-5412
Juju CloudSpec API could leak senstive information
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
| CWE | CWE-285 |
| Vendor | canonical |
| Product | juju |
| Ecosystems | |
| Industries | Technology |
| Published | Apr 10, 2026 |
| Last Updated | Apr 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for canonical juju
Be the first to know when new critical vulnerabilities affecting canonical juju are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Canonical / Juju
2.9.0 < 2.9.57 3.6.0 < 3.6.21
References
Credits
Ales Stimec