JU
Product
Juju
20
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 2High 5Medium 12Low 1
Watch
Add Juju to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4370 | 10.0 | Apr 1 | Improper TLS Client/Server authentication and certificate verification on Database Cluster Affected: 3.2.0 before 3.6.20; 4.0 before 4.0.4 |
| CVE-2017-9232 | 9.8 | May 28 | Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the… Affected: through 1.25.12; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +32 more |
| CVE-2026-32693 | 8.8 | Mar 18 | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead… Affected: 3.0.0 before 3.6.19 |
| CVE-2025-0928 | 8.8 | Jul 8 | In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without… Affected: before 2.9.52; 3.0 before 3.6.8 |
| CVE-2024-7558 | 8.0 | Oct 2 | JUJU_CONTEXT_ID is a predictable authentication secret Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 before 3.2.4; 3.3.0 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2015-1316 | 7.5 | Apr 22 | Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key Affected: before 1.25.5 |
| CVE-2026-93336 New | 7.1 | Oct 22 | Missing authorization in the unit resources download route in Juju controllers Affected: 4.0 before 4.0.16 |
| CVE-2026-32694 | 6.6 | Mar 18 | In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret… Affected: 3.0.0 before 3.6.19 |
| CVE-2026-5412 | 6.5 | Apr 10 | Juju CloudSpec API could leak senstive information Affected: 2.9.0 before 2.9.57; 3.6.0 before 3.6.21 |
| CVE-2025-68153 | 6.5 | Apr 3 | Juju: Resource poisoning Affected: 2.9 through 2.9.55; 3.6 through 3.6.18 |
| CVE-2026-32692 | 6.5 | Mar 18 | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized… Affected: 3.1.6 before 3.6.19 |
| CVE-2025-53513 | 6.5 | Jul 8 | The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm Affected: before 2.9.52; 3.0 before 3.6.8 |
| CVE-2025-53512 | 6.5 | Jul 8 | The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information Affected: before 2.9.52; 3.0 before 3.6.8 |
| CVE-2024-8037 | 6.5 | Oct 2 | Vulnerable juju hook tool abstract UNIX domain socket Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 through 3.2.4; 3.3.0 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2026-5774 | 6.4 | Apr 10 | Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map Affected: 2.0.0 before 2.9.57; 3.0.0 before 3.6.21; 4.0.0 before 4.0.6 |
| CVE-2024-8038 | 5.5 | Oct 2 | Vulnerable juju introspection abstract UNIX domain socket Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 through 3.2.4; 3.3 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2026-32691 | 5.3 | Mar 18 | A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret Affected: 3.0.0 before 3.6.19 |
| CVE-2025-68152 | 4.9 | Apr 3 | Juju: Read All Controller Logs From Compromised Workload Affected: 2.9 through 2.9.55; 3.6 through 3.6.18 |
| CVE-2023-0092 | 4.9 | Jan 31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem Affected: 2.9.22 before 2.9.38; 3.0.0 before 3.0.3 |
| CVE-2024-6984 | 3.8 | Jul 29 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation… Affected: 2.9 before 2.9.50; 3.1 before 3.1.9; 3.3 before 3.3.6; 3.4 before 3.4.5; 3.5 before 3.5.3 |
Showing 20