Read the docs
TI-2024-07452 Aliases CVE-2024-8038GHSA-xwgj-vpm9-q2rq

Vulnerable juju introspection abstract UNIX domain socket.

Priority LOW 34CWE-420Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed Juju (Canonical Ltd.): 3.5.4, 3.4.6, 3.3.7 +2github.com/juju/juju (Go): 0.0.0-20240829052008-43f0fc59790d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju3.5 to before 3.5.4; 3.4 to before 3.4.6; 3.3 to before 3.3.7; 3.1 to before 3.1.10; 2.9 to before 2.9.513.5.4, 3.4.6, 3.3.7, 3.1.10, 2.9.51Patch availableCNA
—github.com/juju/juju (Go)before 0.0.0-20240829052008-43f0fc59790d0.0.0-20240829052008-43f0fc59790dPatch availableGHSA-xwgj-vpm9-q2rq
  • Juju VendorCanonical Affected 3.5 to before 3.5.4; 3.4 to before 3.4.6; 3.3 to before 3.3.7; 3.1 to before 3.1.10; 2.9 to before 2.9.51 Fixed in 3.5.4, 3.4.6, 3.3.7, 3.1.10, 2.9.51 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected before 0.0.0-20240829052008-43f0fc59790d Fixed in 0.0.0-20240829052008-43f0fc59790d Patch available GHSA-xwgj-vpm9-q2rq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*before 2.9.51; 3.1.0 to before 3.1.10; 3.2.0 – 3.2.4; 3.3 to before 3.3.7; 3.4 to before 3.4.6; 3.5.0 to before 3.5.4VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions before 2.9.51; 3.1.0 to before 3.1.10; 3.2.0 – 3.2.4; 3.3 to before 3.3.7; 3.4 to before 3.4.6; 3.5.0 to before 3.5.4 Vulnerable ·Canonical

Remediation

  • Fix · CNA Juju (Canonical Ltd.) Fixed in 3.5.4, 3.4.6, 3.3.7, 3.1.10, 2.9.51
  • Fix · GHSA-xwgj-vpm9-q2rq github.com/juju/juju (Go) Fixed in 0.0.0-20240829052008-43f0fc59790d Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical Juju 2.9.51, 3.1.10 and 3 more versions

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2024-07005 JUJU_CONTEXT_ID is a predictable authentication secret.Priority LOW 38
    • TI-2024-07451 Incorrect default permissions in Canonical JujuPriority LOW 28
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8038
  2. 2026-10-03 Alias added: GHSA-xwgj-vpm9-q2rq

References

Patch 1

Advisory 2

Other 4

  • TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences