{"id":"CVE-2026-5412","revision":"929c6eff63ad4f6597798269b261fc63","records":[{"revision":"929c6eff63ad4f6597798269b261fc63","observedAt":"2026-10-27T14:13:29.239+00:00","statement":{"source":"nvd","id":"CVE-2026-5412","aliases":[],"title":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a lo…","description":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.","state":0,"publishedAt":"2026-04-10T13:16:45.78+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security@ubuntu.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/juju/juju/pull/22205","https://github.com/juju/juju/pull/22206","https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5412","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-285"],"productCriteria":["cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-10T13:16:45.780","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-5412","identifiers":["CVE-2026-5412"]},"retained":false,"historicalAffected":[]}],"coverage":[]}