PT-2026-31912 · Canonical · Juju

Ales Stimec · CVE-2026-5412 · Published 2026-04-10 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juju versions prior to 2.9.57 and 3.6.21

Description Juju versions prior to 2.9.57 and 3.6.21 contain an authorization issue in the Controller facade. An authenticated user can call the CloudSpec API method to extract cloud credentials used for bootstrapping the controller. This allows a low-privileged user to access sensitive credentials.

Recommendations Update to Juju version 2.9.57 or later. Update to Juju version 3.6.21 or later.

Exploit

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-5412

GHSA-W5FQ-8965-C969

GO-2026-5692

OPENSUSE-SU-2026:21483-1

Affected Products

Juju

References · 1758

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5412.json · Exploit
• 🔥 https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969 · Exploit
• https://github.com/juju/juju/pull/22205 · Patch
• https://github.com/juju/juju/pull/22206 · Patch
• https://osv.dev/vulnerability/GO-2026-5692 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w5fq-8965-c969 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5412 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/juju/juju · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note