CVE-2026-93336 — Vulnerability intelligence

Canonical — Juju

Published: 2026-10-22T17:32:13.820Z

CVSS

7.1

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with only login permission) to read any application's charm resource in any model,  including container-registry credentials, via a crafted request naming an arbitrary unit.

Sources

• CVE-2026-93336
• Original advisory
• Original advisory
• CVE-2026-93336