Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Canonical Juju 2.9.52, 3.6.8 Clear all filters
TI-2025-00786 CVE-2025-0928 · GHSA-4vc8-wvhw-m5gv

Arbitrary executable upload via authenticated endpoint

Priority HIGH 73

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring expli…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00695 Published 2025-07-08 Fixed in 2.9.52, 3.6.8 +1 CWE-285
TI-2025-33458 CVE-2025-53513 · GHSA-24ch-w38v-xmh8

Zip slip vulnerability in Juju

Priority HIGH 73

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00777 Published 2025-07-08 Fixed in 2.9.52, 3.6.8 +1 CWE-24
TI-2025-33457 CVE-2025-53512 · GHSA-r64v-82fh-xc63

Sensitive log retrieval in Juju

Priority MEDIUM 62

The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00378 Published 2025-07-08 Fixed in 2.9.52, 3.6.8 +1 CWE-200