# CVE-2026-5412: Canonical Juju improper authorization in Controller facade

Source: https://junglewise.ai/threats/cve-2026-5412-canonical-juju-improper-authorization-in-controller-facade  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-5412 · Severity: critical · CVSS 9.9 · Published 2026-04-10

Juju, an open-source orchestration engine for deploying and managing software in the cloud, contains a vulnerability that allows users with basic login access to view sensitive cloud credentials. An attacker with standard user permissions and knowledge of a specific identifier (the model UUID) can retrieve the credentials used to set up the controller. This could lead to unauthorized access to the underlying cloud infrastructure, potentially allowing an attacker to modify or destroy cloud resources.

Technologies: [Canonical Juju](https://junglewise.ai/threats/technologies/juju), [github.com/juju/juju (Go)](https://junglewise.ai/threats/technologies/github-com-juju-juju). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-5412 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5412 being exploited in the wild.

**How severe is CVE-2026-5412?** Critical severity, with a CVSS score of 9.9, published 10 April 2026.

**Which products and versions are affected?** Canonical Juju 2.9, 3.6, 4.0.6; github.com/juju/juju (Go) < 0.0.0-20260408003526-d395054dc2c3, SEMVER:introduced=0,fixed=0.0.0-20260408003526-d395054dc2c3.

**Is there a fix for CVE-2026-5412?** Yes. github.com/juju/juju (Go): upgrade to 0.0.0-20260408003526-d395054dc2c3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5412 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-5412?** Check whether you run Canonical Juju or github.com/juju/juju (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/juju/juju (Go): upgrade to 0.0.0-20260408003526-d395054dc2c3 or later

  ```sh
  go get github.com/juju/juju@v0.0.0-20260408003526-d395054dc2c3
  ```


## Technical details

An improper authorization vulnerability (CWE-285) exists in the Juju Controller facade's CloudSpec method. While this method is intended for internal workers and administrative CLI tasks (like 'kill-controller'), it is exposed to any authenticated client with basic logon permissions. If an attacker knows the controller model UUID, they can invoke the CloudSpec method to retrieve the cloud credentials used during the controller's bootstrap process. This vulnerability affects Juju versions 2.9, 3.6, and 4.0.6. A fix has been identified to restrict credential access to superusers or model admins, though users are currently advised to restrict ingress to the controller API port 17070.

## Affected products

- Canonical Juju 2.9, 3.6, 4.0.6

## Identifiers

- CVE-2026-5412
- GHSA-w5fq-8965-c969
- GO-2026-5692

## Timeline

- 2026-04-10: advisory: GHSA-w5fq-8965-c969 published
- 2026-04-10: patched: Fix identified in specific Go module versions

## References

- [https://api.github.com/users/alesstimec](https://api.github.com/users/alesstimec)
- [https://github.com/alesstimec](https://github.com/alesstimec)
- [https://api.github.com/users/alesstimec/gists%7B/gist_id%7D](https://api.github.com/users/alesstimec/gists%7B/gist_id%7D)
- [https://api.github.com/users/alesstimec/repos](https://api.github.com/users/alesstimec/repos)
- [https://avatars.githubusercontent.com/u/5555154?v=4](https://avatars.githubusercontent.com/u/5555154?v=4)
- [https://api.github.com/users/alesstimec/events%7B/privacy%7D](https://api.github.com/users/alesstimec/events%7B/privacy%7D)

## Related threats

- [Canonical Juju missing authorization in unit resources download](https://junglewise.ai/threats/cve-2026-93336-missing-authorization-in-the-unit-resources-download-route-in)
- [Canonical Juju race condition in API server userTokens map](https://junglewise.ai/threats/cve-2026-5774-canonical-juju-race-condition-in-api-server-usertokens-map)
- [Canonical Juju incorrect authorization in resource handler](https://junglewise.ai/threats/cve-2025-68153-canonical-juju-incorrect-authorization-in-resource-handler)
- [Canonical Juju Incorrect Authorization in Debug Log Endpoint](https://junglewise.ai/threats/cve-2025-68152-canonical-juju-incorrect-authorization-in-debug-log-endpoint)
- [Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster](https://junglewise.ai/threats/cve-2026-4370-juju-has-improper-tls-client-server-authentication-and-certificate)