CVE-2026-5412

CriticalPublic PoC

Published: 10 April 2026

Published

10 April 2026

Modified

30 April 2026

KEV Added

—

Patch

—

CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0001 1.3th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5412 is a critical-severity Improper Authorization (CWE-285) vulnerability in Canonical Juju. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 1.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations on API methods like CloudSpec to prevent low-privileged users from extracting sensitive cloud bootstrap credentials.

AC-6 Least Privilege good match

prevent

Applies least privilege to restrict access to controller cloud credentials only to necessary high-privileged roles, blocking low-privileged exploitation.

AC-25 Reference Monitor good match

prevent

Implements a reference monitor in the Controller facade to mediate and enforce access control policies, directly countering the authorization bypass vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552 Unsecured Credentials Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Authorization bypass in network-accessible Juju controller API enables exploitation of public-facing application to extract cloud credentials, directly mapping to T1190 and T1552 Unsecured Credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user…

to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

Deeper analysisAI

CVE-2026-5412 is an authorization bypass vulnerability (CWE-285) in the Controller facade of Juju versions prior to 2.9.57 and 3.6.21. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller, enabling access to sensitive information by low-privileged users. The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low complexity, and high impacts across confidentiality, integrity, and availability in a changed scope.

A low-privileged authenticated user can exploit this issue remotely without user interaction. By invoking the affected API method, the attacker gains unauthorized access to cloud credentials, which could facilitate broader compromise of cloud environments managed by the Juju controller.

Mitigation is provided in Juju versions 2.9.57 and 3.6.21, as detailed in the security advisory at GHSA-w5fq-8965-c969 and pull requests 22205 and 22206 on the Juju GitHub repository. Practitioners should upgrade affected deployments to these versions to address the authorization flaw.