TI-2026-00957 Aliases CVE-2026-1237 GHSA-j477-6vpg-6c8x

Improper signature verification in Canonical juju

LOW 10CWE-347Published 2026-01-28 · Updated 2026-01-28

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00142 3rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	juju	all versions	—	No fix listed	CNA
—	github.com/juju/juju (Go)	up to 0.0.0-20260127110037-9b1a0e53a4a4	—	No fix listed	GHSA-j477-6vpg-6c8x

juju VendorCanonical Affected all versions Fixed in — No fix listed CNA
github.com/juju/juju (Go) Vendor— Affected up to 0.0.0-20260127110037-9b1a0e53a4a4 Fixed in — No fix listed GHSA-j477-6vpg-6c8x

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:juju::::::::	—	—	Canonical

cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions — — ·Canonical

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-1237
2026-10-03 Alias added: GHSA-j477-6vpg-6c8x

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-1237

Other 3

TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8

See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences