CVE-2026-5412
Published: 10 April 2026
Summary
CVE-2026-5412 is a critical-severity Improper Authorization (CWE-285) vulnerability in Canonical Juju. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-5412 is an authorization bypass vulnerability (CWE-285) in the Controller facade of Juju versions prior to 2.9.57 and 3.6.21. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller, enabling access to sensitive information by low-privileged users. The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low complexity, and high impacts across confidentiality, integrity, and availability in a changed scope.
A low-privileged authenticated user can exploit this issue remotely without user interaction. By invoking the affected API method, the attacker gains unauthorized access to cloud credentials, which could facilitate broader compromise of cloud environments managed by the Juju controller.
Mitigation is provided in Juju versions 2.9.57 and 3.6.21, as detailed in the security advisory at GHSA-w5fq-8965-c969 and pull requests 22205 and 22206 on the Juju GitHub repository. Practitioners should upgrade affected deployments to these versions to address the authorization flaw.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21364
Vulnerability details
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user…
more
to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass in network-accessible Juju controller API enables exploitation of public-facing application to extract cloud credentials, directly mapping to T1190 and T1552 Unsecured Credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on API methods like CloudSpec to prevent low-privileged users from extracting sensitive cloud bootstrap credentials.
Applies least privilege to restrict access to controller cloud credentials only to necessary high-privileged roles, blocking low-privileged exploitation.
Implements a reference monitor in the Controller facade to mediate and enforce access control policies, directly countering the authorization bypass vulnerability.