TI-2025-00786 Aliases CVE-2025-0928 GHSA-4vc8-wvhw-m5gv

Arbitrary executable upload via authenticated endpoint

HIGH 73CWE-285Published 2025-07-08 · Updated 2025-07-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285 and CWE-434.

Summary

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00695 53rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Juju (Canonical): 2.9.52, 3.6.8github.com/juju/juju (Go): 0.0.0-20250619215741-4034aa13c7cf

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Canonical	Juju	2.0.0 to before 2.9.52; 3.0.0 to before 3.6.8	2.9.52, 3.6.8	Patch available	CNA
—	github.com/juju/juju (Go)	before 0.0.0-20250619215741-4034aa13c7cf	0.0.0-20250619215741-4034aa13c7cf	Patch available	GHSA-4vc8-wvhw-m5gv

Juju VendorCanonical Affected 2.0.0 to before 2.9.52; 3.0.0 to before 3.6.8 Fixed in 2.9.52, 3.6.8 Patch available CNA
github.com/juju/juju (Go) Vendor— Affected before 0.0.0-20250619215741-4034aa13c7cf Fixed in 0.0.0-20250619215741-4034aa13c7cf Patch available GHSA-4vc8-wvhw-m5gv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:canonical:juju::::::::	before 2.9.52; 3.0 to before 3.6.8	Vulnerable	Canonical

cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions before 2.9.52; 3.0 to before 3.6.8 Vulnerable ·Canonical

Remediation

Fix · CNA Juju (Canonical) Fixed in 2.9.52, 3.6.8
Fix · GHSA-4vc8-wvhw-m5gv github.com/juju/juju (Go) Fixed in 0.0.0-20250619215741-4034aa13c7cf Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-07-08
Canonical Juju 2.9.52, 3.6.8
3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2025-33458 Zip slip vulnerability in JujuPriority HIGH 73
- TI-2025-33457 Sensitive log retrieval in JujuPriority MEDIUM 62
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-0928
2026-10-03 Alias added: GHSA-4vc8-wvhw-m5gv
2026-10-09 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-0928

Other 6

TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
TI-2025-33457 Sensitive log retrieval in Juju CVSS 3.1MEDIUM 6.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences