PT-2026-30121 · Juju · Juju

Published 2026-04-03 · Updated 2026-04-03 · CVE-2025-68153

NVD

CVSS v4.0

7.1

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-68153

Affected Products

Juju

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-68153 · Security Note
• https://github.com/juju/juju/security/advisories/GHSA-245v-p8fj-vwm2 · Note
• https://github.com/juju/juju/commit/26ff93c903d55b0712c6fb3f6b254710edb971d4 · Note