{"id":"CVE-2026-93336","kind":"vulnerability","aliases":["CVE-2026-93336"],"related":[],"title":"Canonical Juju: unit agents can read other applications' charm resources and credentials","description":"Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.","summary":"Juju 4.0 through 4.0.15 lacks an authorization check on the unit resources download route. A principal with only a unit agent or login permission can request any unit's resources and read charm resources from any model, including container-registry credentials.","severity":"high","cvss":7.1,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["canonical","charms","infrastructure","juju","kubernetes"],"not_affected_if":["juju-outside-4.0.x"],"how_to_check":"- Run `juju version` and compare against the fixed release in the advisory\n- Check whether the controller runs Juju 4.0 through `4.0.15`","fix":"- Upgrade the Juju controller to a release later than `4.0.15` (the fixed version is unknown from the sources)\n- Rotate any container-registry credentials stored as charm resources in affected models","status":"open","published_at":"2026-10-22T18:17:32+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:31:32+00:00","updated_at":"2026-10-25T03:31:32+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:31:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Juju controller to a release later than `4.0.15` (the fixed version is unknown from the sources)\n- Rotate any container-registry credentials stored as charm resources in affected models","reach":"network","title":"Canonical Juju: unit agents can read other applications' charm resources and credentials","impact":"high","summary":"Juju 4.0 through 4.0.15 lacks an authorization check on the unit resources download route. A principal with only a unit agent or login permission can request any unit's resources and read charm resources from any model, including container-registry credentials.","category":"infrastructure","nicknames":[],"who_cares":["juju","canonical","kubernetes","charms"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads registry credentials and charm resources from any model","analyst_note":"Find the fixed Juju version and any vendor advisory from Canonical; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93336 may list it.","how_to_check":"- Run `juju version` and compare against the fixed release in the advisory\n- Check whether the controller runs Juju 4.0 through `4.0.15`","needs_analyst":true,"not_affected_if":["juju-outside-4.0.x"],"who_is_affected":"Operators running a Juju 4.0 controller up to and including 4.0.15 are exposed, since any authenticated controller principal can use the route. Teams that store container-registry credentials in charm resources face the most risk. Deployments on releases outside 4.0.x are not covered by the sources.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3361,"output_tokens":577,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93336':15A,18A '4.0':25B,77C '4.0.15':27B,79C 'agent':4A,44B,88C 'allow':80C 'applic':8A,99C 'arbitrari':117C 'authent':84C 'author':30B,67C 'canon':1A,19B,75C 'charm':9A,20B,56B,101C 'check':31B 'contain':63B,108C 'container-registri':62B,107C 'control':83C 'controller-authent':82C 'craft':113C 'credenti':12A,65B,110C 'cve':13A,16A 'download':36B,72C 'includ':61B,106C 'infrastructur':21B 'juju':2A,22B,24B,76C 'kubernet':23B 'lack':28B 'login':46B,94C 'miss':66C 'model':60B,105C 'name':115C 'permiss':47B,95C 'princip':39B,85C 'read':6A,55B,97C 'registri':64B,109C 'request':49B,114C 'resourc':10A,35B,53B,57B,71C,102C 'rout':37B,73C 'unit':3A,34B,43B,51B,70C,87C,118C 'user':91C 'via':111C","nicknames":[],"mitigations":[],"who_affected":"Operators running a Juju 4.0 controller up to and including 4.0.15 are exposed, since any authenticated controller principal can use the route. Teams that store container-registry credentials in charm resources face the most risk. Deployments on releases outside 4.0.x are not covered by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@ubuntu.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93336","severity":null,"published_at":"2026-10-22T18:17:32+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-93336","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93336","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}