External risk intelligence

Juju Dqlite Cluster Authentication Bypass Allows Data Compromise.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-4370

The vulnerability affects an internal Dqlite database cluster port used for Juju controller node communication. While network-reachable, this port is intended for administrative cluster synchronization between controller nodes, not for public internet exposure. Typical deployments place these management interfaces behind internal network controls, making direct public internet access uncommon.

Missing Authentication

Canonical Juju

3.2.0 to before 3.6.204.0 to before 4.0.5

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Juju's internal database cluster allows unauthorized access, potentially leading to complete data compromise. The flaw involves a failure to properly authenticate connections, enabling unauthenticated attackers to join the cluster and gain full read and write privileges to the data.

Internal database authentication weakness found.
Confirms relevance and exposure of this Juju issue.
Understand internal cluster access risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by connecting to the Juju controller's database port over the network. The flaw lies in the Dqlite database cluster's failure to properly verify the identity of new nodes trying to join. This allows an unauthenticated attacker to join the cluster and gain complete control over the data within the database.

Requires network access to the database port.
Attacker joins the database cluster.
Leads to total data compromise.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access to the Juju controller's Dqlite port could join the database cluster, gaining complete read and write access to all stored data. This could affect system configuration and operational data.

System data and operational state at risk.
Attacker joins database cluster via network.
Total compromise of stored database information.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Juju platform team is likely responsible for this vulnerability, as it affects the internal Dqlite database cluster. The first practical step is to inventory all Juju controllers, confirm their network exposure, and identify the business criticality of each instance. Then, prioritize remediation based on risk, coordinating with the vendor if necessary.

Juju platform team owns the issue.
Verify controller network reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Juju and how does it use Dqlite?

Juju is an open-source orchestration engine used to deploy, manage, and scale complex software applications across various cloud and physical infrastructure. It utilizes Dqlite, a distributed SQL engine, as its internal database to maintain state and configuration settings across controller nodes. This database ensures that all nodes in a Juju cluster remain synchronized and functional.

What does CWE-295 and CWE-306 mean for CVE-2026-4370?

These codes identify weaknesses related to improper certificate validation and missing authentication. In the context of CVE-2026-4370, the Juju controller fails to verify the identity of new nodes attempting to join the database cluster. Because the system does not enforce strict TLS certificate checks or require proper credentials, it allows unauthorized entities to bypass security controls and connect to the cluster.

How can an attacker trigger this Juju vulnerability?

An attacker triggers the flaw by establishing a network connection to the specific port used by the Juju controller's Dqlite database. The vulnerability does not allow access to the wider Juju environment unless the attacker can successfully mimic a node and join the database cluster. If the controller port is unreachable over the network, the attacker cannot initiate the unauthorized join process.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that this vulnerability affects an internal administrative port designed for communication between controller nodes. While the flaw allows network-based exploitation, public internet exposure is uncommon for these management interfaces. Systems are typically protected by internal network controls, making direct outside access unlikely in most standard, secure deployments.

What should I do if I use Juju in my environment?

Begin by inventorying all Juju controllers to determine if they fall within the affected version ranges. Evaluate your network architecture to confirm that the Dqlite database port is isolated from untrusted networks and not directly accessible. Once your footprint is understood, prioritize updating these instances to a secure version provided by the vendor to remediate the authentication failure.

References

github.com/juju/juju/security/advisories/GHSA-gvrj-cjch-728p

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.