CVSS 4.0
2.1 lowCVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:LCVE-2026-1237
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-347, CWE-672
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j477-6vpg-6c8x | Go | github.com/juju/juju | <=0.0.0-20260127110037-9b1a0e53a4a4 | no fix published |
| GO-2026-4388 | Go | github.com/juju/juju | all versions | no fix published |