CVE-2026-93336

HighCVSS 7.1

Published: 22/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Canonical Juju versions 4.0 through 4.0.15 lack authorization in the unit resources download route. A controller-authenticated principal (a unit agent or a user with only login permission) can read any application's charm resources in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.

Risk Assessment

Unauthorized access to charm resources and container-registry credentials of other applications and models is possible. This can lead to disclosure of sensitive data and further escalation within the Juju environment.

Recommendation

Upgrade Canonical Juju to a version later than 4.0.15. Until then, restrict user and unit agent permissions and monitor for unusual resource download requests.

Other vulnerabilities in Canonical Juju

CVE-2026-5774Medium
Canonical Juju 4.0.5, 3.6.20, and 2.9.56 have improper synchronization of the userTokens map in the API server. This may allow an authenticated user to cause a denial of service or reuse a single-use discharge token.

Original NVD description (English source)

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS