CVE-2026-5412

CVE-2026-5412 is an authorization bypass vulnerability in Juju's Controller facade that affects versions prior to 2.9.57 and 3.6.21. Authenticated users can exploit an insufficiently restricted CloudSpec API method to extract sensitive cloud credentials used during controller bootstrap, compromising the integrity of cloud infrastructure access controls. The vulnerability carries a CVSS score of 9.9 (Critical) with a network attack vector requiring only low-level user privileges. The attack requires no user interaction and impacts confidentiality, integrity, and availability across connected systems. The relatively low EPSS score of 0.00015 suggests minimal exploitation likelihood compared to other disclosed vulnerabilities, though the critical severity rating warrants immediate patching. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and has inactive status on security hotlists. However, the straightforward nature of the attack and the critical impact assessment suggest organizations should prioritize upgrading to patched versions 2.9.57 or 3.6.21 to prevent potential credential compromise.