CVE-2026-5412: fallo crítico en Canonical Juju
Juju CloudSpec API could leak senstive information
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.9epss 0.5%
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
Canonical · JujuCVEs relacionadas — Canonical Juju
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-53513HIGHZip slip vulnerability in JujuEPSS 0.8%CVE-2025-0928HIGHArbitrary executable upload via authenticated endpointEPSS 0.7%CVE-2026-4370CRITICALImproper TLS Client/Server authentication and certificate verification on Database ClusterEPSS 0.4%CVE-2025-53512MEDIUMSensitive log retrieval in JujuEPSS 0.4%CVE-2026-32693HIGHUnauthorized access to Kubernetes secrets in JujuEPSS 0.3%CVE-2026-32694MEDIUMInsecure Direct Object Reference attack via predictable secret ID in JujuEPSS 0.3%