CVE-2026-4370

The Juju controller uses an internal Dqlite database cluster, which should require mutual TLS authentication (mTLS) when joining new nodes. The vulnerability exists because the database endpoint does not verify client certificates when a new node attempts to join the cluster. An attacker who is network-reachable on the Dqlite controller port can establish a connection without any credentials and register as a new cluster node. After successfully joining, the attacker gains full read and write permissions to the entire database.

An attacker can gain full read and write access to the Juju internal database, resulting in complete compromise of confidentiality and integrity of stored data, and potentially also takeover of control of the managed infrastructure.

Juju should be updated to version 3.6.19 or newer (for the 3.x branch) or to version 4.0.4 or newer (for the 4.x branch). Additionally, it is recommended to restrict network access to the Dqlite controller port to trusted hosts only using a firewall or network rules.

Canonical Juju in versions from 3.2.0 to 3.6.18 (before 3.6.19) and in versions from 4.0 to 4.0.3 (before 4.0.4)