Read the docs
TI-2026-04739 Aliases CVE-2026-5412GHSA-w5fq-8965-c969

Juju CloudSpec API could leak senstive information

Priority MEDIUM 43CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Juju (Canonical): 2.9.57, 3.6.21github.com/juju/juju (Go): 0.0.0-20260408003526-d395054dc2c3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju2.9.0 to before 2.9.57; 3.6.0 to before 3.6.212.9.57, 3.6.21Patch availableCNA
—github.com/juju/juju (Go)before 0.0.0-20260408003526-d395054dc2c30.0.0-20260408003526-d395054dc2c3Patch availableGHSA-w5fq-8965-c969
  • Juju VendorCanonical Affected 2.9.0 to before 2.9.57; 3.6.0 to before 3.6.21 Fixed in 2.9.57, 3.6.21 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected before 0.0.0-20260408003526-d395054dc2c3 Fixed in 0.0.0-20260408003526-d395054dc2c3 Patch available GHSA-w5fq-8965-c969

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*before 2.9.57; 3.6 to before 3.6.21VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions before 2.9.57; 3.6 to before 3.6.21 Vulnerable ·Canonical

Remediation

  • Fix · CNA Juju (Canonical) Fixed in 2.9.57, 3.6.21
  • Fix · GHSA-w5fq-8965-c969 github.com/juju/juju (Go) Fixed in 0.0.0-20260408003526-d395054dc2c3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5412
  2. 2026-10-03 Alias added: GHSA-w5fq-8965-c969

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences