Dashboard / CVE-2026-5412

CVE-2026-5412

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 63/100
Published: 2026-04-10 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
canonical juju < 2.9.57

References & Advisories (3)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.45%
Raw Score 0.004450
Percentile 38.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00445
2026-10-28
0.00445

Intelligence Sources

nvd ref →

External Links