CVE-2026-5412: 
NixOS vulnerability analysis and mitigation

CVE-2026-5412 is an improper authorization vulnerability in Canonical's Juju orchestration software, specifically in the Controller facade's CloudSpec API method, that allows any authenticated low-privileged user to extract cloud credentials used to bootstrap the controller. It affects Juju versions prior to 2.9.57 and 3.6.21 (including 4.0.6 from the 4.0/edge snap channel). The vulnerability was published on April 10, 2026. The GitHub Security Advisory rates it Critical with a CVSS v3.1 score of 9.9, while NVD assigns a score of 6.5 (Medium) — the discrepancy reflects differing scope assessments (Github Advisory, Juju Advisory).

The root cause is CWE-285 (Improper Authorization): the CloudSpec method on the Juju Controller facade does not enforce sufficient permission checks before returning cloud credential data. The CloudSpec API is legitimately used by internal controller workers to maintain cloud connectivity, but it is also accessible to any authenticated client caller — including those invoked via juju kill-controller — without requiring superuser or model admin privileges. An attacker who has login access to the controller and knows the controller model UUID can directly call this API method over the controller API port (TCP 17070) to retrieve the bootstrap cloud credentials. The fix restricts credential details to controller superusers or model admins, while still allowing non-sensitive public cloud information (e.g., cloud endpoint) to be read by lower-privileged users (Juju Advisory, PR #22205, PR #22206).

Successful exploitation allows any authenticated Juju user — regardless of privilege level — to obtain the cloud credentials (e.g., AWS, Azure, GCP, or OpenStack credentials) used to bootstrap the Juju controller. These credentials typically carry broad cloud-level permissions, enabling an attacker to pivot from a low-privileged Juju account to full cloud infrastructure control, including provisioning or destroying cloud resources, accessing other workloads, and potentially exfiltrating sensitive data across the entire cloud environment. The scope change reflected in the Critical CVSS rating captures this cross-boundary impact: compromise of the Juju controller credential can cascade to the underlying cloud provider (Juju Advisory).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.012% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only valid login credentials to the Juju controller and knowledge of the controller model UUID, making it accessible to any insider or compromised low-privileged account with network access to port 17070.

1. Obtain Juju credentials: Acquire any valid Juju user account with login permission to the target controller (e.g., through credential theft, phishing, or insider access).
2. Identify the controller endpoint: Determine the controller's API address and port (default TCP 17070), and obtain the controller model UUID (available via juju show-controller or from Juju configuration files).
3. Authenticate to the controller: Use the Juju CLI (juju login) or a programmatic client (e.g., libjuju) to establish an authenticated session with the controller using the low-privileged credentials.
4. Call the CloudSpec API: Invoke the CloudSpec method on the Controller facade, supplying the controller model UUID. This can be done via the Juju API directly (e.g., using a custom Go client or libjuju) without requiring elevated permissions.
5. Extract cloud credentials: Parse the API response to retrieve the cloud credentials (API keys, secrets, tokens) used to bootstrap the controller, which can then be used to authenticate directly to the underlying cloud provider (Juju Advisory).

• Network: Unexpected or anomalous API connections to Juju controller port TCP 17070 from non-administrative client IPs; API calls to the Controller facade's CloudSpec method from accounts that are not superusers or model admins.
• Logs: Juju controller audit logs showing CloudSpec API method invocations by low-privileged user accounts; repeated or scripted API calls to the controller model UUID endpoint.
• Cloud Provider: Unexpected API activity or resource provisioning in the cloud environment using the bootstrap credentials (e.g., new IAM role assumptions, unusual resource creation/deletion in AWS CloudTrail, Azure Activity Log, or GCP Audit Logs).
• Process/Behavior: Use of juju kill-controller by non-administrative users, which triggers the CloudSpec API call as part of its workflow (Juju Advisory).

Upgrade Juju to version 2.9.57 or later (for the 2.9.x branch) or 3.6.21 or later (for the 3.6.x branch); patches were merged via pull requests #22205 (2.9 branch) and #22206 (3.6 branch) on April 10, 2026. For deployments that cannot be immediately upgraded, the only available workaround is to restrict network ingress to the controller API port 17070 on all controller machines (VM deployments) or the controller Kubernetes service (k8s deployments), while ensuring that legitimate Juju CLI, libjuju, and JAAS clients retain necessary access. Additionally, review and rotate any cloud credentials that may have been exposed if the deployment was running a vulnerable version (Juju Advisory, PR #22205, PR #22206).

The vulnerability was discovered by alesstimec and remediated by wallyworld (developer) and hpidcock (reviewer) from the Juju/Canonical team. The NixOS security tracker bot filed issues against nixpkgs (NixOS/nixpkgs#508879) shortly after disclosure, indicating community awareness and downstream packaging impact. No significant broader media coverage or notable external researcher commentary has been identified beyond standard vulnerability database aggregation (Juju Advisory, PR #22206).