Missing Auth in Juju 4.0 Unit Resource Download (v4.0-4.0.15)
CVE-2026-93336 Published on October 22, 2026
Missing authorization in the unit resources download route in Juju controllers
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
Vulnerability Analysis
CVE-2026-93336 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-93336 has been classified to as an AuthZ vulnerability or weakness.
Affected Versions
Canonical Juju:- Version 4.0 and below 4.0.16 is affected.