CVE-2025-68152

low-risk
Published 2026-04-03

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.9/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Juju

Affected Vendors

Canonical

References (3)

Patch https://github.com/juju/juju/commit/22cdcf6b54c2f371822e1c203d4f341be6c9589e
Patch https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3
Vendor Advisory https://github.com/juju/juju/security/advisories/GHSA-j6f6-jp3p-53mw
25
/ 100
low-risk
Severity 20/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal