CVE-2026-4370

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-4370

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4370.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-4370

Aliases

Published

2026-04-01T08:09:17.570Z

Modified

2026-07-08T08:13:27.726467939Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Improper TLS Client/Server authentication and certificate verification on Database Cluster

Details

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.0.4"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4370.json",
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-295",
        "CWE-306"
    ]
}

References

Affected packages

Git / github.com/juju/juju

Affected ranges

Type

GIT

Repo

https://github.com/juju/juju

Events

Introduced

c7107ada8c471aa3ba105e5433e61861227e2ed4

Fixed

8da14f62e48aca8627da67f8cad47d0a4fb60587

Introduced

766e8bca985b3f7c350666d36106389bc38b7af2

Fixed

7e79756810ccde1f570d0a270c235d218455ab77

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.6.20"
        },
        {
            "introduced": "4.0"
        },
        {
            "fixed": "4.0.5"
        }
    ]
}

Affected versions

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4370.json"