CVE-2026-93336
CVE-2026-93336 · Missing authorization in the unit resources download route in Juju controllers
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
juju
- Versions
- ≥ 4.0, < 4.0.16: Affected (semver)
Update to 4.0.16