CVE-2026-5412

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This issue is resolved in Juju versions 2.9.57 and 3.6.21.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285

Affected software

VendorProductVersions
CanonicalJuju>= 2.9.0, < 2.9.57; >= 3.6.0, < 3.6.21

References

Timeline

Published
Apr 10, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-541208.8Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.CVE-2026-541218.8Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.CVE-2026-541228.4Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.CVE-2026-541235.5Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose infoCVE-2026-541247.8Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally.CVE-2026-541257.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attackerCVE-2026-541266.5Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.CVE-2026-541278.4Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.CVE-2026-541288.4Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.CVE-2026-541297.8Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-54133.7A vulnerability was identified in Newgen OmniDocs up to 12.0.00. Affected by this vulnerability is an unknown functionality of the file /omnCVE-2026-541307.5Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-5412: Medium severity, CVSS 6.5 | Vulnix