An authentication bypass, identified as CWE‑862, in the unit resources download endpoint of Canonical Juju 4.x allows any controller‑authenticated principal, including unit agents and users with only login rights, to download any application's charm resource across all models. This flaw enables the attacker to obtain sensitive data such as container‑registry credentials, effectively exposing confidential model information without proper authorization.

The defect exists in Canonical’s Juju product version 4.0 through 4.0.15. Any Juju controller running within that range and regularly integrating with multiple models is susceptible. All installed controllers in that version window need to be verified for a pending update.

The vulnerability has a CVSS score of 7.1, indicating a high likelihood of impact on confidentiality. The EPSS score is unavailable, but the flaw is not listed in the CISA KEV catalog. The attack requires only controller credentials, which are relatively common and can be obtained by actors with moderate access. A crafted HTTP request targeting an arbitrary unit can retrieve any charm resource, making exploitation straightforward once authenticated. Consequently, exposed credentials and other sensitive artefacts can be leveraged for further attacks on the underlying infrastructure.