CVE-2026-4370 - Vulnerability Analysis

Overview

Juju 3.2.0 to 3.6.19 and 4.0 to 4.0.4 contains a broken authentication caused by improper TLS client and server authentication in the internal Dqlite database cluster, letting unauthenticated attackers with network access join the cluster and gain full database access.

Severity & Score

Impact

Unauthenticated attackers can join the database cluster and gain full read and write access, leading to total data compromise.

Mitigation

Update to a version later than 3.6.19 or 4.0.4 or the latest available version.

References

• https://github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner