cve.bz

CVE-2025-68152

6.9 mediumEPSS 0.4%

Medium (6.9) in canonical juju. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/juju/juju 0.0.0-20250623030540-c91a1f404695.

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.

Severity

CVSS 4.0

6.9 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.9 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j6f6-jp3p-53mwGogithub.com/juju/juju<0.0.0-20250623030540-c91a1f4046950.0.0-20250623030540-c91a1f404695
GO-2026-5451Gogithub.com/juju/juju<0.0.0-20250623030540-c91a1f4046950.0.0-20250623030540-c91a1f404695

References

Check your stackJSON