CVE-2026-93336
Missing authorization in the unit resources download route in Juju controllers
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
| CWE | CWE-862 |
| Vendor | canonical |
| Product | juju |
| Ecosystems | |
| Industries | Technology |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for canonical juju
Be the first to know when new unknown vulnerabilities affecting canonical juju are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Canonical / Juju
4.0 < 4.0.16
References
Credits
🔍 Eurico Nicacio