CVE-2026-93336

Name of the Vulnerable Software and Affected Versions Canonical Juju versions 4.0 through 4.0.15

Description Missing authorization in the unit resources download route allows a controller-authenticated principal, such as a unit agent or a user with only login permissions, to read charm resources of any application in any model. This can be achieved via a crafted request naming an arbitrary unit, potentially exposing sensitive data like container-registry credentials.

Recommendations Update Canonical Juju to a version later than 4.0.15.