CVE-2026-4370 Details

A vulnerability exists in Juju versions 3.2.0 prior to 3.6.19 and 4.0 prior to 4.0.4, where the internal Dqlite database cluster fails to enforce proper TLS client and server authentication. The issue arises because the Juju controller's database endpoint does not validate client certificates when a new node attempts to join the cluster. This flaw allows an unauthenticated attacker with network access to the Juju controller's Dqlite port to join the database cluster. Once connected, the attacker gains full read and write access to the database, leading to complete data compromise.

Users can update to Juju versions 3.6.20 or 4.0.5, both of which address this vulnerability. If immediate updating is not possible, Juju controllers can be configured to block incoming connections to port 17666, except from other controller IP addresses. For environments using Kubernetes, apply a network policy to restrict access to the Dqlite port.