Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure, Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-209, CWE-269 and CWE-284.
Summary
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/juju/juju (Go) | before 2.9.50 | 2.9.50 | Patch available | GHSA-6vjm-54vp-mxhx |
| — | github.com/juju/juju (Go) | 3.0.0 to before 3.1.9 | 3.1.9 | Patch available | GHSA-6vjm-54vp-mxhx |
| — | github.com/juju/juju (Go) | 3.2.0 to before 3.3.6 | 3.3.6 | Patch available | GHSA-6vjm-54vp-mxhx |
| — | github.com/juju/juju (Go) | 3.4.0 to before 3.4.5 | 3.4.5 | Patch available | GHSA-6vjm-54vp-mxhx |
| — | github.com/juju/juju (Go) | 3.5.0 to before 3.5.3 | 3.5.3 | Patch available | GHSA-6vjm-54vp-mxhx |
- github.com/juju/juju (Go) Vendor— Affected before 2.9.50 Fixed in 2.9.50 Patch available GHSA-6vjm-54vp-mxhx
- github.com/juju/juju (Go) Vendor— Affected 3.0.0 to before 3.1.9 Fixed in 3.1.9 Patch available GHSA-6vjm-54vp-mxhx
- github.com/juju/juju (Go) Vendor— Affected 3.2.0 to before 3.3.6 Fixed in 3.3.6 Patch available GHSA-6vjm-54vp-mxhx
- github.com/juju/juju (Go) Vendor— Affected 3.4.0 to before 3.4.5 Fixed in 3.4.5 Patch available GHSA-6vjm-54vp-mxhx
- github.com/juju/juju (Go) Vendor— Affected 3.5.0 to before 3.5.3 Fixed in 3.5.3 Patch available GHSA-6vjm-54vp-mxhx
Remediation
- Fix · GHSA-6vjm-54vp-mxhx github.com/juju/juju (Go) Fixed in 2.9.50 Advisory →
- Fix · GHSA-6vjm-54vp-mxhx github.com/juju/juju (Go) Fixed in 3.1.9 Advisory →
- Fix · GHSA-6vjm-54vp-mxhx github.com/juju/juju (Go) Fixed in 3.3.6 Advisory →
- Fix · GHSA-6vjm-54vp-mxhx github.com/juju/juju (Go) Fixed in 3.4.5 Advisory →
- Fix · GHSA-6vjm-54vp-mxhx github.com/juju/juju (Go) Fixed in 3.5.3 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-6vjm-54vp-mxhx
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences