PT-2026-31912 · Canonical · Juju

Ales Stimec · Published 2026-04-10 · Updated 2026-05-14 · CVE-2026-5412

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juju versions prior to 2.9.57 and 3.6.21

Description Juju versions prior to 2.9.57 and 3.6.21 contain an authorization issue in the Controller facade. An authenticated user can call the CloudSpec API method to extract cloud credentials used for bootstrapping the controller. This allows a low-privileged user to access sensitive credentials.

Recommendations Update to Juju version 2.9.57 or later. Update to Juju version 3.6.21 or later.

Exploit

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-5412

GHSA-W5FQ-8965-C969

Affected Products

Juju

References · 19

• 🔥 https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969 · Exploit
• https://github.com/juju/juju/pull/22205 · Patch
• https://github.com/juju/juju/pull/22206 · Patch
• https://osv.dev/vulnerability/GHSA-w5fq-8965-c969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5412 · Security Note
• https://github.com/juju/juju · Note
• https://twitter.com/lyrie_ai/status/2054830644971143206 · Twitter Post
• https://twitter.com/_cvereports/status/2049068805058437595 · Twitter Post
• https://twitter.com/pulsepatchio/status/2042798522316034128 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042593636555145236 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1skdkn8/resumen_diario_de_vulnerabilidades_13042026 · Reddit Post
• https://twitter.com/0dayPublishing/status/2042583266637537535 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2042935709749637176 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2044045509804118193 · Twitter Post
• https://twitter.com/CVEnew/status/2042593146874531998 · Twitter Post