CVE-2026-5412: Juju CloudSpec Method Leaking Cloud Credentials Vulnerability
CRITICALCVE-2026-5412 is a CRITICAL (CVSS 9.9) cloudspec method leaking cloud credentials vulnerability (CWE-285: Improper Authorization) affecting Juju libraries in the Go ecosystem. The issue involves cloudspec method leaking cloud credentials. Remediation is available by upgrading affected packages to version 0.0.0-20260408003526-d395054dc2c3.
CVE-2026-5412 at a Glance
Security Impact
CVSS: 9.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
How to Fix CVE-2026-5412
To remediate this vulnerability, upgrade all affected Juju dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/juju/juju to 0.0.0-20260408003526-d395054dc2c3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/juju/jujuHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-5412, inspect your project dependencies for Juju:
inspect dependencies for github.com/juju/jujuAnalyze the terminal output to locate any version of Juju in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260408003526-d395054dc2c3), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Juju, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-5412 Affected Juju Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/juju/juju
|
Go |
< 0.0.0-20260408003526-d395054dc2c3
|
0.0.0-20260408003526-d395054dc2c3
|
References
Frequently Asked Questions
What is CVE-2026-5412?
Which Juju versions are affected?
What version fixes CVE-2026-5412?
Is github.com/juju/juju affected?
What is the CVSS score of CVE-2026-5412?
What CWE is associated with CVE-2026-5412?
How can I check Go dependencies for CVE-2026-5412?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-w5fq-8965-c969",
"modified" : "2026-04-10T21:00:16Z",
"published" : "2026-04-10T21:00:16Z",
"aliases" : [ "CVE-2026-5412" ],
"summary" : "Juju: CloudSpec method leaking cloud credentials",
"details" : "### Impact\n\nIf a user has login permission to a controller and knows the controller model UUID, they can call the CloudSpec method on the Controller facade and get cloud credentials used to bootstrap the controller.\n\nThe CloudSpec API is called by workers running in the controller to maintain connection to the cloud - this aspect is not the issue. The API is also called by the CLI when killing (force destroying a controller with `juju kill-controller`). This is the problematic aspect. The API is exposed to any client caller where that client has nothing more than logon permission on the controller. What should happen is that getting access to the credential should be limited to those client connections where the authenticated user has superuser or model admin permission.\n\nThis affect 2.9, 3.6, 4.0.6 (snap from 4.0/edge channel).\n\nThe fix will allow non-confidential, public information like cloud endpoint etc to be read, but only controller superusers or model admins will be able to see the credential details.\n\n### Patches\n\nNo patch exists.\n\n### Workarounds\n\nThe only mitigation is to restrict ingress to the controller API port 17070 on all controller machines (for vm deployments) or the controller service (for k8s deployments). The Juju CLI and other clients like libjuju or JAAS require ingress to port 17070 so any restricted access will need to take into account those access requirements.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/juju/juju"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.0.0-20260408003526-d395054dc2c3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/juju/juju/security/advisories/GHSA-w5fq-8965-c969"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-5412"
}, {
"type" : "WEB",
"url" : "https://github.com/juju/juju/pull/22205"
}, {
"type" : "WEB",
"url" : "https://github.com/juju/juju/pull/22206"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/juju/juju"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-285" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-10T21:00:16Z",
"nvd_published_at" : "2026-04-10T13:16:45Z"
}
}