Read the docs
TI-2025-41732 Aliases CVE-2025-68152GHSA-j6f6-jp3p-53mw

Juju: Read All Controller Logs From Compromised Workload

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00369 30th percentileScored 2026-11-07
Fix Fixed juju (juju): 2.9.56, 3.6.19github.com/juju/juju (Go): 0.0.0-20250623030540-c91a1f404695

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jujujuju2.9 to before 2.9.56; 3.6 to before 3.6.192.9.56, 3.6.19Patch availableCNA
—github.com/juju/juju (Go)before 0.0.0-20250623030540-c91a1f4046950.0.0-20250623030540-c91a1f404695Patch availableGHSA-j6f6-jp3p-53mw
  • juju Vendorjuju Affected 2.9 to before 2.9.56; 3.6 to before 3.6.19 Fixed in 2.9.56, 3.6.19 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected before 0.0.0-20250623030540-c91a1f404695 Fixed in 0.0.0-20250623030540-c91a1f404695 Patch available GHSA-j6f6-jp3p-53mw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*2.9 – 2.9.55; 3.6 – 3.6.18VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions 2.9 – 2.9.55; 3.6 – 3.6.18 Vulnerable ·Canonical

Remediation

  • Fix · CNA juju (juju) Fixed in 2.9.56, 3.6.19
  • Fix · GHSA-j6f6-jp3p-53mw github.com/juju/juju (Go) Fixed in 0.0.0-20250623030540-c91a1f404695 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68152
  2. 2026-10-03 Alias added: GHSA-j6f6-jp3p-53mw

References

Patch 2

Advisory 2

Other 1

  • TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences