CVE-2026-93336: Missing authorization in the unit resources download route in Juju controllers

Q: Which principals can exploit this issue?

Any principal authenticated to the controller can exploit it if it is a unit agent or a user account with only login permission. The issue does not require model-level access to the target application's resources.

Q: What data could be exposed?

An attacker can read charm resources belonging to any application in any model by crafting a request that names an arbitrary unit. Exposed resources can include container-registry credentials.

Q: How can an attacker reach resources outside their authorized model or application?

The vulnerable download route accepts a crafted request naming an arbitrary unit, and it does not enforce authorization for the requested resource. This permits cross-application and cross-model resource reads by an authenticated controller principal.

Published Oct 22, 2026

Updated

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.

Affected Software

1 affected component

Canonical Juju>=4.0<=4.0.15

Event History

Oct 22, 2026

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

DescriptionWeakness

Frequently Asked Questions

Which principals can exploit this issue?

Any principal authenticated to the controller can exploit it if it is a unit agent or a user account with only login permission. The issue does not require model-level access to the target application's resources.

What data could be exposed?

An attacker can read charm resources belonging to any application in any model by crafting a request that names an arbitrary unit. Exposed resources can include container-registry credentials.

How can an attacker reach resources outside their authorized model or application?

The vulnerable download route accepts a crafted request naming an arbitrary unit, and it does not enforce authorization for the requested resource. This permits cross-application and cross-model resource reads by an authenticated controller principal.