CVE-2026-5412
Juju CloudSpec API could leak senstive information
- State
- Published
- Severity
- 9.9 Critical
- Published
- Apr 10, 2026
- Updated
- Apr 10, 2026
- Reserved
- Apr 2, 2026
Description
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | canonical |
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
JujuCanonical |
|
References
- CloudSpec method leaking cloud credentialsvdb-entryvendor-advisory
- https://github.com/juju/juju/pull/22206patchissue-tracking
- https://github.com/juju/juju/pull/22205patchissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.