Read the docs
TI-2026-79391 Aliases CVE-2026-93336GHSA-43hf-rrv4-hhf5

Missing authorization in Canonical Juju unit resources download route

Priority LOW 31CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Canonical Juju 4.0 from 4.0 before 4.0.16 is affected. The unit resources download route does not check authorization. A controller-authenticated principal, such as a unit agent or a user with only login permission, can read any application's charm resource in any model, including container-registry credentials, by sending a crafted request that names an arbitrary unit. This is CWE-862.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed Juju (Canonical): 4.0.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju4.0 to before 4.0.164.0.16Patch availableCNA
  • Juju VendorCanonical Affected 4.0 to before 4.0.16 Fixed in 4.0.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*——Canonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions — — ·Canonical

Remediation

Upgrade Canonical Juju 4.0 to 4.0.16 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA Juju (Canonical) Fixed in 4.0.16

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-93336
  2. 2026-10-22 Alias added: GHSA-43hf-rrv4-hhf5
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-11-02 CISA SSVC decision points changed

References

Patch 1

Advisory 1

  • TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
See all 4301 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences