CVE-2026-1237

The record

Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or expired permissions. This allows a charm to continue relating to another charm in a cross-model relation, and use their workload without their permission. No fix is available as of the time of writing.

Affected packages

Related vulnerabilities

• CVE-2017-9232 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… Also affects github.com/juju/juju
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
• CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
• CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
• CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
• CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb
• CVE-2026-27018 Gotenberg is an API for converting document formats. Also affects govulncheck-vulndb