Live › vulnerability › CVE-2026-93336
Go to dashboardJuju 4.0 through 4.0.15 lacks an authorization check on the unit resources download route. A principal with only a unit agent or login permission can request any unit's resources and read charm resources from any model, including container-registry credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Operators running a Juju 4.0 controller up to and including 4.0.15 are exposed, since any authenticated controller principal can use the route. Teams that store container-registry credentials in charm resources face the most risk. Deployments on releases outside 4.0.x are not covered by the sources.
No product ranges from the sources yet.
juju version and compare against the fixed release in the advisory4.0.154.0.15 (the fixed version is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.
This page as .md · .json · in your agent: get_signal("CVE-2026-93336")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.