Medium severity · published Apr 3, 2026
CVE-2025-68153
Juju: Resource poisoning
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JU
juju · juju
>= 2.9, < 2.9.56; >= 3.6, < 3.6.19 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68153
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68153
Patch
https://github.com/juju/juju/commit/26ff93c903d55b0712c6fb3f6b254710edb971d4
Vendor Advisory
https://github.com/juju/juju/security/advisories/GHSA-245v-p8fj-vwm2
More from juju
4.9
CVE-2025-68152
Juju: Read All Controller Logs From Compromised Workload
