CVE-2026-5412— Juju CloudSpec API could leak senstive information
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-5412
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Juju CloudSpec API could leak senstive information
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juju 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juju是Canonical Juju开源的一个开源应用程序编排引擎。 Juju 2.9.57之前版本和3.6.21之前版本存在安全漏洞，该漏洞源于授权问题，可能导致低权限用户访问敏感凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2026-5412
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8629 chars
Paid plan includes:
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-5412
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Juju
- CVE-2026-5774
Juju API Server Denial of Service and Authentication Replay - CVE-2025-68153
Juju: Resource poisoning - CVE-2025-68152
Juju: Read All Controller Logs From Compromised Workload - CVE-2026-4370
Improper TLS Client/Server authentication and certificate ve - CVE-2026-32694
Insecure Direct Object Reference attack via predictable secr
Same vendor: Canonical
- CVE-2026-6970
authd Denial of Service and Local Privilege Escalation - CVE-2026-6369
Exposed Session Token in canonical-livepatch client snap - CVE-2026-5774
Juju API Server Denial of Service and Authentication Replay - CVE-2025-14551
Senstive information disclosure was affecting subiquity - CVE-2025-15480
Senstive information disclosure was affecting ubuntu-desktop
Same weakness: CWE-285
- CVE-2026-8241
Industrial Application Software IAS Canias ERP RMI iasGetSer - CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint all - CVE-2026-33823
Microsoft Team Events Portal Information Disclosure Vulnerab - CVE-2026-41572
Note Mark: Unauthenticated read of notes and assets in soft- - CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route k
V. Comments for CVE-2026-5412
No comments yet