{"id":"GHSA-w5fq-8965-c969","revision":null,"records":[{"revision":"da4e1208d68247ae8b51263e331515a1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-5412","aliases":[],"title":"Juju CloudSpec API could leak senstive information","description":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.","state":0,"publishedAt":"2026-04-10T12:22:05.403+00:00","modifiedAt":"2026-04-10T14:04:30.155+00:00","affected":[{"ecosystem":"https://github.com/juju/","name":"juju","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Canonical\",\n                    \"product\": \"Juju\",\n                    \"platforms\": [\n                        \"Linux\"\n                    ],\n                    \"collectionURL\": \"https://github.com/juju/\",\n                    \"packageName\": \"juju\",\n                    \"repo\": \"https://github.com/juju/juju\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2.9.0\",\n                            \"lessThan\": \"2.9.57\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"3.6.0\",\n                            \"lessThan\": \"3.6.21\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"}],"references":["https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969","https://github.com/juju/juju/pull/22206","https://github.com/juju/juju/pull/22205"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-5412","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-5412","identifiers":["CVE-2026-5412"]},"retained":false,"historicalAffected":[]},{"revision":"be3b9129903741508c7caeb32b3e920f","observedAt":"2026-10-28T08:07:16.87+00:00","statement":{"source":"euvd","id":"EUVD-2026-21364","aliases":["CVE-2026-5412"],"title":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a lo…","description":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":null}],"references":["https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969","https://github.com/juju/juju/pull/22206","https://github.com/juju/juju/pull/22205"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-21364","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 10, 2026, 12:22:05 PM","dateUpdated":"Apr 10, 2026, 2:04:30 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-21364","identifiers":["EUVD-2026-21364","CVE-2026-5412"]},"retained":false,"historicalAffected":[]},{"revision":"929c6eff63ad4f6597798269b261fc63","observedAt":"2026-10-27T14:13:29.239+00:00","statement":{"source":"nvd","id":"CVE-2026-5412","aliases":[],"title":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a lo…","description":"In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.","state":0,"publishedAt":"2026-04-10T13:16:45.78+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security@ubuntu.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/juju/juju/pull/22205","https://github.com/juju/juju/pull/22206","https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-5412","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-285"],"productCriteria":["cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-10T13:16:45.780","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-5412","identifiers":["CVE-2026-5412"]},"retained":false,"historicalAffected":[]},{"revision":"b30388584c4645d48d03ce9eaf75522d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-w5fq-8965-c969","aliases":["CVE-2026-5412","GO-2026-5692"],"title":"Juju: CloudSpec method leaking cloud credentials","description":"### Impact\n\nIf a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller.\n\nThe CloudSpec API is called by workers running in the controller to maintain connection to the cloud - this aspect is not the issue. The  API is also called by the CLI when killing (force destroying a controller with `juju kill-controller`). This is the problematic aspect. The API is exposed to any client caller where that client has nothing more than logon permission on the controller. What should happen is that getting access to the credential should be limited to those client connections where the authenticated user has superuser or model admin permission.\n\nThis affect 2.9, 3.6, 4.0.6 (snap from 4.0/edge channel).\n\nThe fix will allow non-confidential, public information like cloud endpoint etc to be read, but only controller superusers or model admins will be able to see the credential details.\n\n### Patches\n\nNo patch exists.\n\n### Workarounds\n\nThe only mitigation is to restrict ingress to the controller API port 17070 on all controller machines (for vm deployments) or the controller service (for k8s deployments). The Juju CLI and other clients like libjuju or JAAS require ingress to port 17070 so any restricted access will need to take into account those access requirements.","state":0,"publishedAt":"2026-04-10T21:00:16+00:00","modifiedAt":"2026-06-25T23:11:47.0075233+00:00","affected":[{"ecosystem":"Go","name":"github.com/juju/juju","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260408003526-d395054dc2c3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969","https://nvd.nist.gov/vuln/detail/CVE-2026-5412","https://github.com/juju/juju/pull/22205","https://github.com/juju/juju/pull/22206","https://github.com/juju/juju"],"sourceUrl":"https://github.com/advisories/GHSA-w5fq-8965-c969","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-w5fq-8965-c969","identifiers":["GHSA-w5fq-8965-c969","CVE-2026-5412","GO-2026-5692"]},"retained":false,"historicalAffected":[]},{"revision":"af48de1d19a44fd8a396132ce9a1f88d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5692","aliases":["CVE-2026-5412","GHSA-w5fq-8965-c969"],"title":"Juju: CloudSpec method leaking cloud credentials in github.com/juju/juju","description":"Juju: CloudSpec method leaking cloud credentials in github.com/juju/juju","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-06-25T23:01:27.3811907+00:00","affected":[{"ecosystem":"Go","name":"github.com/juju/juju","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260408003526-d395054dc2c3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969","https://nvd.nist.gov/vuln/detail/CVE-2026-5412","https://github.com/juju/juju/pull/22205","https://github.com/juju/juju/pull/22206"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5692","license":"OSV · upstream source license applies","key":"osv:GO-2026-5692","identifiers":["GO-2026-5692","CVE-2026-5412","GHSA-w5fq-8965-c969"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T04:49:00.5013535+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T04:49:00.5013535+00:00","lastSuccessAt":"2026-10-30T04:49:00.6414495+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.6414504+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-2e71aeeaba1e737812d17410e1484919534917ed0495906eec4eca846085ee8f","complete":true,"records":416922,"lastAttemptAt":"2026-10-30T04:48:59.4263515+00:00","lastSuccessAt":"2026-10-30T04:48:59.3474102+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:48:59.4263515+00:00","snapshotPublishedAt":"2026-10-30T04:27:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2897fb2ade7642b5a71112974bcfc1c1","complete":false,"records":13518,"lastAttemptAt":"2026-10-30T05:01:03.5048342+00:00","lastSuccessAt":"2026-10-30T05:01:03.492+00:00","error":"23 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T05:01:03.492+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13143,"expectedIdentifiers":13601,"failedIdentifiers":23},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T04:49:00.5013535+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T04:49:00.5013535+00:00","lastSuccessAt":"2026-10-30T04:49:00.6424189+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.6424193+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dff131a3390246408db17133f034dc7f","complete":true,"records":13541,"lastAttemptAt":"2026-10-30T04:49:01.1833908+00:00","lastSuccessAt":"2026-10-30T03:49:22.155+00:00","error":null,"lastVerifiedAt":"2026-10-30T03:49:22.155+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13601,"expectedIdentifiers":13601,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-ed3d9cf8b8585536fcb9b5cdf9f82e66117dc54e56de651034444f578191d1cf","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T04:49:00.0803085+00:00","lastSuccessAt":"2026-10-30T03:49:17.6553909+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.0803085+00:00","snapshotPublishedAt":"2026-10-30T03:03:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T04:48:59.5832538+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:48:59.5832538+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3d73c87158b66efc3d2abd577048eff6d8962b9b8404ac23159c8b20cd3852a7","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T04:49:00.4664018+00:00","lastSuccessAt":"2026-10-30T03:49:20.7978659+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:49:00.4664018+00:00","snapshotPublishedAt":"2026-10-30T03:03:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T04:48:59.9718614+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T04:48:59.9718614+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}