Low severityNVD Advisory· Published Jan 28, 2026· Updated Jun 17, 2026
CVE-2026-1237
CVE-2026-1237
Description
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/juju/jujuGo | <= 0.0.0-20260127110037-9b1a0e53a4a4 | — |
Affected products
3- ghsa-coords3 versionspkg:golang/github.com/juju/jujupkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
<= 0.0.0-20260127110037-9b1a0e53a4a4+ 2 more
- (no CPE)range: <= 0.0.0-20260127110037-9b1a0e53a4a4
- (no CPE)range: < 0.0.20260205T172317-150000.1.146.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.