PT-2025-28503 · Canonical · Juju

Tlm · Published 2025-07-08 · Updated 2026-01-08 · CVE-2025-0928

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Juju versions prior to 3.6.8 Juju versions prior to 2.9.52

Description: The issue allows any authenticated controller user to upload arbitrary agent binaries to any model or to the controller itself without verifying model membership or requiring explicit permissions. This enables the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.

Recommendations: For versions prior to 3.6.8, update to version 3.6.8 or later. For versions prior to 2.9.52, update to version 2.9.52 or later.

Exploit

Fix

RCE

Improper Authorization

Unrestricted File Upload

Weakness Enumeration

CWE-285

CWE-434

Related Identifiers

CVE-2025-0928

GHSA-4VC8-WVHW-M5GV

GO-2025-3805

OPENSUSE-SU-2025:15405-1

Affected Products

Juju

References · 70

• 🔥 https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv · Exploit
• https://osv.dev/vulnerability/CVE-2025-0928 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4vc8-wvhw-m5gv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0928 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://github.com/juju/juju/commit/22cdcf6b54c2f371822e1c203d4f341be6c9589e · Note
• https://github.com/juju/juju · Note
• https://github.com/juju/juju/commit/311e374cb8d2431032c51fb3fb5c4b0aaaa7196c · Note
• https://github.com/juju/juju/commit/b4176e6e45c2c3c817ab60b39e2d52f9a11a5ddf · Note
• https://github.com/juju/juju/commit/4034aa13c7cf5a37427fcd032925d5d21955b096 · Note
• https://t.me/cveNotify/148061 · Telegram Post
• https://suse.com/security/cve/CVE-2025-3227 · Note
• https://suse.com/security/cve/CVE-2025-54059 · Note
• https://suse.com/security/cve/CVE-2025-53547 · Note