PT-2026-30121 · Canonical · Juju

Published 2026-04-03 · Updated 2026-04-06 · CVE-2025-68153

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Juju versions 2.9 through 2.9.55 and 3.6 through 3.6.18

Description Juju, an application orchestration engine, allows any authenticated user, machine, or controller to modify application resources within a Juju controller. This impacts versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19.

Recommendations Update to Juju version 2.9.56 or later. Update to Juju version 3.6.19 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-68153

GHSA-245V-P8FJ-VWM2

GO-2026-4924

Affected Products

Juju

References · 7

• https://github.com/juju/juju/commit/26ff93c903d55b0712c6fb3f6b254710edb971d4 · Patch
• https://github.com/juju/juju/security/advisories/GHSA-245v-p8fj-vwm2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-245v-p8fj-vwm2 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68153 · Security Note
• https://github.com/juju/juju · Note
• https://twitter.com/CVEnew/status/2040111824952266959 · Twitter Post