CVE-2026-4370: Canonical Juju Auth Bypass Vulnerability

CVE-2026-4370 Overview

CVE-2026-4370 is a certificate validation vulnerability [CWE-295] in Canonical Juju, affecting the internal Dqlite database cluster. The flaw exists in Juju versions 3.2.0 through 3.6.19 and 4.0 through 4.0.4. The Juju controller's Dqlite endpoint fails to validate client certificates when a new node attempts to join the cluster. An unauthenticated attacker with network access to the Dqlite port can join the database cluster directly. Once joined, the attacker obtains full read and write access to the underlying database, resulting in complete data compromise.

Critical Impact

Network-reachable attackers can join the Juju controller's Dqlite cluster without authentication and gain full read/write access to all controller data.

Affected Products

• Canonical Juju versions 3.2.0 through 3.6.19
• Canonical Juju versions 4.0 through 4.0.4
• Juju controllers exposing the internal Dqlite database port

Discovery Timeline

• 2026-04-01 - CVE-2026-4370 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-4370

Vulnerability Analysis

Juju is Canonical's open-source application orchestration engine for cloud and Kubernetes workloads. The Juju controller stores its operational state in Dqlite, a distributed SQLite variant that uses Raft consensus for replication across controller nodes. Dqlite nodes communicate over TLS and rely on mutual authentication to restrict cluster membership.

In the affected versions, the controller's Dqlite endpoint accepts incoming cluster join requests without verifying the presenting client's certificate against the trusted certificate authority. The server-side identity check is also weakened, allowing arbitrary peers to negotiate sessions. This breaks the trust boundary that should isolate the database cluster from any unauthenticated network entity.

The consequence is total compromise of controller state. Juju's database contains model configuration, application secrets, machine credentials, and cloud provider credentials used to manage downstream workloads. An attacker reading or modifying this data can pivot to managed clouds, alter deployment manifests, or exfiltrate secrets.

Root Cause

The vulnerability is an improper certificate validation defect [CWE-295] in the Dqlite transport layer used by the Juju controller. Both client and server sides of the TLS handshake fail to enforce the certificate checks required by the cluster's mutual TLS design.

Attack Vector

Exploitation requires network reachability to the Juju controller's Dqlite port and no authentication, user interaction, or privileges. The attacker initiates a Dqlite cluster join handshake. Because client certificate validation is absent, the controller accepts the new node and begins replicating the database. The attacker then issues SQL operations directly against the replicated dataset. Refer to the GitHub Security Advisory GHSA-gvrj-cjch-728p for vendor-provided technical detail.

Detection Methods for CVE-2026-4370

Indicators of Compromise

• Unexpected entries in Juju controller logs indicating a new Dqlite cluster member joining outside of planned controller scaling events.
• TCP connections to the controller's Dqlite port originating from IP addresses that are not part of the documented controller HA set.
• Unexplained changes to Juju model configuration, application secrets, or cloud credentials stored in the controller database.

Detection Strategies

• Audit Dqlite cluster membership using juju administrative tooling and compare current members against the expected controller inventory.
• Inspect controller logs for TLS handshake events on the Dqlite port and flag sessions where the peer certificate was not issued by the controller certificate authority.
• Monitor for network flows to the Dqlite port from sources outside the controller management subnet.

Monitoring Recommendations

• Forward Juju controller logs and host network telemetry to a centralized analytics platform for correlation across controllers.
• Alert on any new Raft peer addition events outside of approved change windows.
• Track outbound activity from controller hosts following suspicious join events to identify credential abuse against managed clouds.

How to Mitigate CVE-2026-4370

Immediate Actions Required

• Upgrade Juju controllers to a fixed release as listed in the Juju security advisory.
• Restrict network access to the controller's Dqlite port to only the IP addresses of legitimate controller HA peers using host or cloud firewall rules.
• Rotate any secrets, cloud credentials, and SSH keys stored in the Juju controller if unauthorized cluster membership cannot be ruled out.

Patch Information

Canonical has released fixed versions beyond Juju 3.6.19 and 4.0.4. Operators should consult the GitHub Security Advisory GHSA-gvrj-cjch-728p for the exact patched release numbers and upgrade procedure for high-availability controllers.

Workarounds

• Place Juju controllers on an isolated management network and block the Dqlite port at the perimeter firewall.
• Use cloud security group rules or Kubernetes NetworkPolicies to allow Dqlite traffic only between known controller pods or instances.
• Until patched, increase logging verbosity on controllers and review Dqlite peer additions daily.

# Example: restrict Dqlite port to known controller peers using iptables
# Replace 17070 with the actual Dqlite port and update peer IPs for your environment
iptables -A INPUT -p tcp --dport 17070 -s 10.0.0.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 17070 -s 10.0.0.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 17070 -s 10.0.0.13 -j ACCEPT
iptables -A INPUT -p tcp --dport 17070 -j DROP