Low severityNVD Advisory· Published Jan 28, 2026· Updated Apr 15, 2026
CVE-2026-1237
CVE-2026-1237
Description
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/juju/jujuGo | <= 0.0.0-20260127110037-9b1a0e53a4a4 | — |
Affected products
2- ghsa-coords2 versions
<= 0.0.0-20260127110037-9b1a0e53a4a4+ 1 more
- (no CPE)range: <= 0.0.0-20260127110037-9b1a0e53a4a4
- (no CPE)range: < 0.0.20260205T172317-150000.1.146.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.