PT-2026-30120 · Canonical · Juju

CVE-2025-68152 · Published 2026-04-03 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Juju versions 2.9 through 2.9.55 and 3.6 through 3.6.18

Description A compromised workload machine under a Juju controller could potentially read any log file for any entity in any model at any level. This affects the application orchestration engine Juju.

Recommendations Update to Juju version 2.9.56 or later. Update to Juju version 3.6.19 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-68152

GHSA-J6F6-JP3P-53MW

GO-2026-5451

OPENSUSE-SU-2026:21483-1

Affected Products

Juju

References · 1745

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68152.json · Exploit
• https://github.com/juju/juju/security/advisories/GHSA-j6f6-jp3p-53mw · Vendor Advisory
• https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3 · Patch
• https://github.com/juju/juju/commit/22cdcf6b54c2f371822e1c203d4f341be6c9589e · Patch
• https://osv.dev/vulnerability/GO-2026-5451 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6f6-jp3p-53mw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68152 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68152 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/juju/juju · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note