CVE-2026-1237: Low severity juju vulnerability
Impact
Cross-model Relation authorization is broken and has a potential security vulnerability. If the controller does not have the root key to verify the macaroon (or if the macaroon has expired), an unvalidated and therefore untrusted macaroon is used to extract declared caveats. Facts from these caveats are then blindly used to mint a new macaroon that becomes valid.
Scenario
A user knows that user X has access to offer Y. The user mints a macaroon stating that user X has access to offer Y and sends it to the controller in a request. The controller fails to verify the macaroon because it lacks the root key and mints a new macaroon requiring proof that user X has access to offer Y. Since user X does have access and the discharge endpoint does not require authentication, the controller returns the new macaroon. The user can then use the returned macaroon to consume the offer as user X.
Patches
N/A
Workarounds
A previous proposal via this PR addresses the issue but would break model migrations since macaroon root keys are not included in model descriptions. Additionally, root keys are not model-scoped, making it unclear which keys to transfer during migration.
Other sources
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1237?
CVE-2026-1237 has a medium severity rating due to the risks associated with unvalidated macaroons.
How do I fix CVE-2026-1237?
To fix CVE-2026-1237, update to the latest version of Juju that includes the security patch for this vulnerability.
What are the potential impacts of CVE-2026-1237?
The potential impacts of CVE-2026-1237 include unauthorized access and potential manipulation of services due to broken authorization.
Which software is affected by CVE-2026-1237?
CVE-2026-1237 affects the Juju software and specifically versions up to 0.0.0-20260127110037-9b1a0e53a4a4.
What is a macaroon in relation to CVE-2026-1237?
In relation to CVE-2026-1237, a macaroon is a type of authorization token that can become untrusted if not properly validated.