CVE-2026-93336

{
  "etk_id": "ETK-2026-2488",
  "cve_id": "CVE-2026-93336",
  "display_id": "CVE-2026-93336",
  "ghsa_id": "GHSA-43hf-rrv4-hhf5",
  "euvd_id": "EUVD-2026-108266",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Canonical Juju resource downloads",
  "summary": "Canonical Juju 4.0 through 4.0.15 improperly authorizes resource-download requests. A controller-authenticated unit agent or user with only login permission may read charm resources belonging to applications in other models, including potentially sensitive registry credentials, by requesting another unit's resource. The attacker must already be authenticated to the Juju controller.",
  "mitigation": "Restrict controller access to trusted principals and remove unnecessary login-only accounts or unit-agent credentials. Upgrade to a vendor-fixed release when its supported fixed version is identified; the supplied evidence does not name one.",
  "vendor": "Canonical",
  "product": "Juju",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0, < 4.0.16"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.0.16"
      ],
      "package_name": "juju",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-10-22T17:32:13.820000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T17:32:13.820000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T17:32:13.820000+00:00",
      "url": "https://github.com/advisories/GHSA-43hf-rrv4-hhf5"
    }
  }
}