PT-2026-30120 · Canonical · Juju

Published 2026-04-03 · Updated 2026-04-03 · CVE-2025-68152

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Juju versions 2.9 through 2.9.55 and 3.6 through 3.6.18

Description A compromised workload machine under a Juju controller could potentially read any log file for any entity in any model at any level. This affects the application orchestration engine Juju.

Recommendations Update to Juju version 2.9.56 or later. Update to Juju version 3.6.19 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-68152

GHSA-J6F6-JP3P-53MW

Affected Products

Juju

References · 7

• https://github.com/juju/juju/commit/22cdcf6b54c2f371822e1c203d4f341be6c9589e · Patch
• https://github.com/juju/juju/security/advisories/GHSA-j6f6-jp3p-53mw · Vendor Advisory
• https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-68152 · Security Note
• https://osv.dev/vulnerability/GHSA-j6f6-jp3p-53mw · Vendor Advisory
• https://github.com/juju/juju · Note
• https://twitter.com/CVEnew/status/2040111826198040715 · Twitter Post