CVE-2026-93336
CVE-2026-93336 · Missing authorization in the unit resources download route in Juju controllers
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
CVSS 7.1 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
juju
- Versiones
- ≥ 4.0, < 4.0.16: Afectada (semver)
Actualiza a 4.0.16