Read the docs
TI-2026-03806 Aliases CVE-2026-4370GHSA-gvrj-cjch-728p

Improper TLS Client/Server authentication and certificate verification on Database Cluster

Priority HIGH 82CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295 and CWE-306.

Summary

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Juju (Canonical): 3.6.20, 4.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju3.2.0 to before 3.6.20; 4.0 to before 4.0.43.6.20, 4.0.4Patch availableCNA
—github.com/juju/juju (Go)up to 0.0.0-20260401092550-1c1ac1922b57—No fix listedGHSA-gvrj-cjch-728p
  • Juju VendorCanonical Affected 3.2.0 to before 3.6.20; 4.0 to before 4.0.4 Fixed in 3.6.20, 4.0.4 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected up to 0.0.0-20260401092550-1c1ac1922b57 Fixed in — No fix listed GHSA-gvrj-cjch-728p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*3.2.0 to before 3.6.20; 4.0 to before 4.0.5VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.6.20; 4.0 to before 4.0.5 Vulnerable ·Canonical

Remediation

  • Fix · CNA Juju (Canonical) Fixed in 3.6.20, 4.0.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4370
  2. 2026-10-03 Alias added: GHSA-gvrj-cjch-728p

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
  • TI-2025-33457 Sensitive log retrieval in Juju CVSS 3.1MEDIUM 6.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences