CVE-2026-5412 - Vulnerability Analysis

Overview

Juju < 2.9.57 and < 3.6.21 contain an information disclosure vulnerability caused by an authorization issue in the Controller facade, letting authenticated users extract cloud credentials, exploit requires user authentication.

Severity & Score

Impact

Low-privileged authenticated users can access sensitive cloud credentials, risking unauthorized access to cloud resources.

Mitigation

Update to versions 2.9.57 or 3.6.21 or later.

References

• https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969
• https://github.com/juju/juju/pull/22205
• https://github.com/juju/juju/pull/22206

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 11, 2026

🔴 CVE-2026-5412 - Critical (9.9) In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5412/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner