Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-5412

Juju CloudSpec API could leak senstive information

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical Juju

Default version status: unaffected

  • 2.9.0 to < 2.9.57affected
  • 3.6.0 to < 3.6.21affected

References