An authorization flaw in Juju’s Controller facade allows an authenticated user to invoke the CloudSpec API and retrieve the cloud credentials that were used to bootstrap the controller. The vulnerability exposes sensitive credential data to a low‑privileged user, resulting in a severe confidentiality breach. The weakness is classed as improper authorization (CWE‑285).

Canonical Juju is affected. Versions prior to 2.9.57 and 3.6.21 have the flaw. Upgrading to Juju 2.9.57 or later, or to Juju 3.6.21 or later, resolves the issue.

The CVSS score of 9.9 indicates critical severity. While an EPSS score was not provided, the vulnerability is not listed in the CISA KEV catalog, suggesting no active exploit reported. An attacker only needs authenticated access with low privileges and can exploit the CloudSpec API to pull credentials. The attack vector is internal to the Juju platform and does not require additional network exposure. Prompt patching is therefore essential to mitigate potential compromise of cloud accounts.