CVE-2026-5412

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5412
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5412.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5412
Aliases
Published
2026-04-10T12:22:05.403Z
Modified
2026-07-08T08:13:44.131355563Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Juju CloudSpec API could leak senstive information
Details

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5412.json",
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-285"
    ]
}
References

Affected packages

Git / github.com/juju/juju

Affected ranges

Type
GIT
Repo
https://github.com/juju/juju
Events
Introduced
ac860f7db4296273ea2cf213115ec2c229d57a07
Fixed
50bd2ae2c22c5de86aef5b678cd75228107165f6
Introduced
6dec77a01480916689430d38ef3e032cb1e06b78
Fixed
d395054dc2c360690239f2aedc6fd3ae9b46e279
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.9.0"
        },
        {
            "fixed": "2.9.57"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.21"
        }
    ]
}

Affected versions

Other
juju-
juju-2.*
juju-2.9.0
juju-2.9.1
juju-2.9.10
juju-2.9.11
juju-2.9.12
juju-2.9.13
juju-2.9.14
juju-2.9.15
juju-2.9.16
juju-2.9.17
juju-2.9.18
juju-2.9.19
juju-2.9.2
juju-2.9.20
juju-2.9.21
juju-2.9.22
juju-2.9.23
juju-2.9.24
juju-2.9.25
juju-2.9.26
juju-2.9.27
juju-2.9.28
juju-2.9.29
juju-2.9.3
juju-2.9.30
juju-2.9.31
juju-2.9.32
juju-2.9.33
juju-2.9.34
juju-2.9.35
juju-2.9.36
juju-2.9.37
juju-2.9.38
juju-2.9.39
juju-2.9.4
juju-2.9.40
juju-2.9.41
juju-2.9.42
juju-2.9.43
juju-2.9.44
juju-2.9.5
juju-2.9.6
juju-2.9.7
juju-2.9.8
juju-2.9.9
v2.*
v2.9.45
v2.9.46
v2.9.47
v2.9.48
v2.9.49
v2.9.53

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5412.json"