An attacker can join a Juju database cluster because the controller does not verify client certificates when a new node attempts to join. Once a node is accepted, the attacker has full read and write access to the database, allowing them to read confidential data, modify records, and potentially disrupt services. The weakness is an example of improper TLS authentication (CWE‑295) and failure to enforce authentication (CWE‑306).

Canonical Juju versions from 3.2.0 through 3.6.19 and from 4.0 through 4.0.4 are affected. Versions prior to 3.2.0 and after 4.0.4 are not vulnerable according to the provided data.

With a CVSS score of 10, the vulnerability is rated as critical, but an EPSS score of less than 1% suggests a low current probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires only network reachability to the controller’s Dqlite port, making it straightforward for an intruder on the same network or with access to an exposed port to exploit the flaw and gain complete control of the underlying database.