CVE-2026-4370

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4370", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-03-18T08:46:09.947Z", "datePublished": "2026-04-01T08:09:17.570Z", "dateUpdated": "2026-04-08T07:27:16.821Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/juju/", "defaultStatus": "unaffected", "packageName": "juju", "platforms": ["Linux"], "product": "Juju", "repo": "https://github.com/juju/juju", "vendor": "Canonical", "versions": [{"lessThan": "3.6.20", "status": "affected", "version": "3.2.0", "versionType": "semver"}, {"lessThan": "4.0.4", "status": "affected", "version": "4.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Harry Pidcock"}, {"lang": "en", "type": "analyst", "value": "Thomas Miller"}, {"lang": "en", "type": "remediation developer", "value": "Joseph Phillips"}, {"lang": "en", "type": "coordinator", "value": "Ian Booth"}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper certificate validation", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-08T07:27:16.821Z"}, "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p"}], "source": {"discovery": "INTERNAL"}, "title": "Improper TLS Client/Server authentication and certificate verification on Database Cluster"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:00:31.628747Z", "id": "CVE-2026-4370", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:01:08.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4370", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T13:00:31.628747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:00:43.615Z"}}], "cna": {"title": "Improper TLS Client/Server authentication and certificate verification on Database Cluster", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Harry Pidcock"}, {"lang": "en", "type": "analyst", "value": "Thomas Miller"}, {"lang": "en", "type": "remediation developer", "value": "Joseph Phillips"}, {"lang": "en", "type": "coordinator", "value": "Ian Booth"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}, {"capecId": "CAPEC-94", "descriptions": [{"lang": "en", "value": "CAPEC-94 Adversary in the Middle (AiTM)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/juju/juju", "vendor": "Canonical", "product": "Juju", "versions": [{"status": "affected", "version": "3.2.0", "lessThan": "3.6.20", "versionType": "semver"}, {"status": "affected", "version": "4.0", "lessThan": "4.0.4", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "juju", "collectionURL": "https://github.com/juju/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p"}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper certificate validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-08T07:27:16.821Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4370", "state": "PUBLISHED", "dateUpdated": "2026-04-08T07:27:16.821Z", "dateReserved": "2026-03-18T08:46:09.947Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-04-01T08:09:17.570Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/juju/", "defaultStatus": "unaffected", "packageName": "juju", "platforms": ["Linux"], "product": "Juju", "repo": "https://github.com/juju/juju", "vendor": "Canonical", "versions": [{"lessThan": "3.6.20", "status": "affected", "version": "3.2.0", "versionType": "semver"}, {"lessThan": "4.0.4", "status": "affected", "version": "4.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1E8860B-D8C6-4795-A4F8-5EA1E8CB2381", "versionEndExcluding": "3.6.20", "versionStartIncluding": "3.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "matchCriteriaId": "D900BC29-F5B7-4485-BB1D-42E9778D0A82", "versionEndExcluding": "4.0.5", "versionStartIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en Juju desde la versi\u00f3n 3.2.0 hasta la 3.6.19 y desde la versi\u00f3n 4.0 hasta la 4.0.4, donde el cl\u00faster de la base de datos Dqlite interna no realiza una autenticaci\u00f3n TLS de cliente y servidor adecuada. Espec\u00edficamente, el punto final de la base de datos del controlador de Juju no valida los certificados del cliente cuando un nuevo nodo intenta unirse al cl\u00faster. Un atacante no autenticado con accesibilidad de red al puerto Dqlite del controlador de Juju puede explotar esta falla para unirse al cl\u00faster de la base de datos. Una vez unido, el atacante obtiene acceso completo de lectura y escritura a la base de datos subyacente, lo que permite un compromiso total de los datos."}], "id": "CVE-2026-4370", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4370", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:00:31.628747Z", "version": "2.0.3"}}]}, "published": "2026-04-01T09:16:17.717", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-306"}], "source": "security@ubuntu.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[3.2.0,3.6.20)"}}, {"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[4.0,4.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Juju", "source": "cna", "vendor": "Canonical"}, "product": "juju", "vendor": "canonical"}], "analysis": {"en": {"generated_at": "2026-04-02T23:20:03.369384+00:00", "value": {"mitigation_remediation": ["Upgrade Juju to the latest released version that includes the TLS client authentication check (see the official advisory for the exact patch version).", "Restrict network access to the Juju controller\u2019s Dqlite port by configuring firewall rules or network segmentation to prevent exposure to untrusted networks.", "Monitor cluster logs for unexpected peer join requests and remove any unauthorized nodes immediately."], "summary": {"action": "Immediate Patch", "impact": "Data Compromise"}, "threat_synthesis": {"affected_systems": "Canonical Juju versions from 3.2.0 through 3.6.19 and from 4.0 through 4.0.4 are affected. Versions prior to 3.2.0 and after 4.0.4 are not vulnerable according to the provided data.", "description_and_impact": "An attacker can join a Juju database cluster because the controller does not verify client certificates when a new node attempts to join. Once a node is accepted, the attacker has full read and write access to the database, allowing them to read confidential data, modify records, and potentially disrupt services. The weakness is an example of improper TLS authentication (CWE\u2011295) and failure to enforce authentication (CWE\u2011306).", "risk_and_exploitability": "With a CVSS score of 10, the vulnerability is rated as critical, but an EPSS score of less than 1% suggests a low current probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires only network reachability to the controller\u2019s Dqlite port, making it straightforward for an intruder on the same network or with access to an exposed port to exploit the flaw and gain complete control of the underlying database."}}}}, "created": "2026-04-02T07:49:45.004329+00:00", "updated": "2026-04-03T09:19:11.432462+00:00", "vendors": ["canonical", "canonical$PRODUCT$juju"]}