CVE-2025-68152

MEDIUM

Juju: Read All Controller Logs From Compromised Workload

Title source: cna
STIX 2.1

Description

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.

References (3)

Core 3

Scores

CVSS v3 4.9
EPSS 0.0036
EPSS Percentile 27.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (4)
canonical/juju 2.9 - 2.9.55
juju/juju 0 - 0.0.0-20250623030540-c91a1f404695Go
juju/juju >= 2.9, < 2.9.56
juju/juju >= 3.6, < 3.6.19
Published Apr 03, 2026
Tracked Since Apr 03, 2026