The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
Priority LOW 20CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing `subprocess.CalledProcessError`. This vulnerability is fixed in 2.15.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00198 9th percentileScored 2026-11-07
Fix Fixed operator (canonical): 2.15.0ops (PyPI): 2.15.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | operator | 2.0.0 to before 2.15.0 | 2.15.0 | Patch available | CNA |
| — | ops (PyPI) | 2.0.0 to before 2.15.0 | 2.15.0 | Patch available | GHSA-hcmv-jmqh-fjgm |
- operator VendorCanonical Affected 2.0.0 to before 2.15.0 Fixed in 2.15.0 Patch available CNA
- ops (PyPI) Vendor— Affected 2.0.0 to before 2.15.0 Fixed in 2.15.0 Patch available GHSA-hcmv-jmqh-fjgm
Remediation
- Fix · CNA operator (canonical) Fixed in 2.15.0
- Fix · GHSA-hcmv-jmqh-fjgm ops (PyPI) Fixed in 2.15.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41129
- 2026-10-03 Alias added: GHSA-hcmv-jmqh-fjgm
References
More Canonical vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-41129 · CVE Program
- CVE-2024-41129 · NVD
- FIRST EPSS
- GHSA-hcmv-jmqh-fjgm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences