CVE-2026-5412

critical · 9.9

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

9.9

CVSS

0.4%

EPSS (exploit prob.)

38th

EPSS percentile

2026-04-10

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-285

Affected products

Vendor	Product	Affected versions
canonical	juju	< 2.9.57
canonical	juju	>= 3.6, < 3.6.21

Check a specific version with /api/v1/cve/match.

References

https://github.com/juju/juju/pull/22205
https://github.com/juju/juju/pull/22206
https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-5412