Juju has broken CMR authorization

published 2026-01-28 9 mo ago modified 2026-06-17 4 mo ago also GHSA-j477-6vpg-6c8x , GO-2026-4388 , EUVD-2026-4900

cvss: 2.1; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits: 0; none known

Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.

Patch / fix

distros 2 links 1

suse opensuse

govulncheck-vulndb openSUSE Leap 15.6 0.0.20260205T172317-150000.1.146.1

suse advisories SUSE-SU-2026:0403-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

github.com/juju/juju#21062 pull request

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 9 mo ago (2026-01-28)

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.1	CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
CNA	4.0	2.1	CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
go	github.com/juju/juju	<=0.0.0-20260127110037-9b1a0e53a4a4 all versions	no fix listed

Affected products

Canonical juju

Classification

Weakness

CWE-672 Operation on a Resource after Expiration or Release
CWE-347 Improper Verification of Cryptographic Signature

References

github.com /juju/juju/pull/21062
web, patch
github.com /juju/juju/security/advisories/GHSA-j477-6vpg-6c8x
web, advisory
nvd.nist.gov /vuln/detail/CVE-2026-1237
advisory
github.com /juju/juju
package

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary