CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
An unauthenticated attacker can join the Juju Dqlite database cluster due to missing certificate validation, gaining full read and write access to the data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4370?
CVE-2026-4370 is a critical authentication bypass vulnerability in Canonical Juju, published on 1 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network reachability to the Juju controller's Dqlite port can exploit this flaw to join the database cluster. Once joined, the attacker gains full read and write access to the underlying database, allowing for total data compromise.
Which versions are affected by CVE-2026-4370?
3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/juju Go | All versions | None |
github.com/juju/juju Go | All versions to 0.0.0-20260401092550-1c1ac1922b57 | None |
github.com/juju/juju Go | All versions to 0.0.0-20260401092550-1c1ac1922b57 | None |
Products include Canonical Juju.
How do I fix CVE-2026-4370?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-4370 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4370 exists.
Other vulnerabilities in Canonical Juju
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions
- CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
- CVE-2025-0928 Arbitrary executable upload via authenticated endpoint
- CVE-2025-53513 Zip slip vulnerability in Juju
Sources
Also known as GHSA-gvrj-cjch-728p, GO-2026-5405.