CVE-2026-1237
Publication date 28 January 2026
Last updated 3 March 2026
Ubuntu priority
Description
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.
Why is this CVE low priority?
Upstream rates this as being low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| juju | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |