PT-2026-29482 · Canonical · Juju

Harry Pidcock

+3

·

CVE-2026-4370

·

Published

2026-04-01

·

Updated

2026-07-30

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Juju versions 3.2.0 through 3.6.19 and versions 4.0.0 through 4.0.4
Description A flaw exists in the Juju software where the internal Dqlite database cluster does not properly validate TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An attacker with network access to the Juju controller's Dqlite port can join the database cluster and gain full read and write access to the database, potentially leading to complete data compromise.
Recommendations Update Juju to a version later than 4.0.4. Update Juju to a version later than 3.6.19.

Exploit

Fix

Missing Authentication

Improper Certificate Validation

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-306CWE-296CWE-295CWE-287

Related Identifiers

CVE-2026-4370
GHSA-GVRJ-CJCH-728P
GO-2026-5405
OPENSUSE-SU-2026:21483-1

Affected Products

Juju