CVE-2026-5412: Canonical Juju improper authorization in Controller facade

Executive brief

Juju, an open-source orchestration engine for deploying and managing software in the cloud, contains a vulnerability that allows users with basic login access to view sensitive cloud credentials. An attacker with standard user permissions and knowledge of a specific identifier (the model UUID) can retrieve the credentials used to set up the controller. This could lead to unauthorized access to the underlying cloud infrastructure, potentially allowing an attacker to modify or destroy cloud resources.

Technical details

An improper authorization vulnerability (CWE-285) exists in the Juju Controller facade's CloudSpec method. While this method is intended for internal workers and administrative CLI tasks (like 'kill-controller'), it is exposed to any authenticated client with basic logon permissions. If an attacker knows the controller model UUID, they can invoke the CloudSpec method to retrieve the cloud credentials used during the controller's bootstrap process. This vulnerability affects Juju versions 2.9, 3.6, and 4.0.6. A fix has been identified to restrict credential access to superusers or model admins, though users are currently advised to restrict ingress to the controller API port 17070.

Affected products

• Canonical Juju 2.9, 3.6, 4.0.6

Timeline

• 2026-04-10: advisory: GHSA-w5fq-8965-c969 published
• 2026-04-10: patched: Fix identified in specific Go module versions

References

• https://api.github.com/users/alesstimec
• https://github.com/alesstimec
• https://api.github.com/users/alesstimec/gists%7B/gist_id%7D
• https://api.github.com/users/alesstimec/repos
• https://avatars.githubusercontent.com/u/5555154?v=4
• https://api.github.com/users/alesstimec/events%7B/privacy%7D