JU
Product
Juju
20
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 2High 5Medium 12Low 1
Watch
Add Juju to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-32694 | 6.6 | Mar 18 | Insecure Direct Object Reference attack via predictable secret ID in Juju Affected: 3.0.0 before 3.6.19 |
| CVE-2026-5412 | 6.5 | Apr 10 | Juju CloudSpec API could leak senstive information Affected: 2.9.0 before 2.9.57; 3.6.0 before 3.6.21 |
| CVE-2025-68153 | 6.5 | Apr 3 | Juju: Resource poisoning Affected: 2.9 through 2.9.55; 3.6 through 3.6.18 |
| CVE-2026-32692 | 6.5 | Mar 18 | Unauthorized update of out-of-scope Vault secrets Affected: 3.1.6 before 3.6.19 |
| CVE-2025-53513 | 6.5 | Jul 8 | The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm Affected: before 2.9.52; 3.0 before 3.6.8 |
| CVE-2025-53512 | 6.5 | Jul 8 | The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information Affected: before 2.9.52; 3.0 before 3.6.8 |
| CVE-2024-8037 | 6.5 | Oct 2 | Vulnerable juju hook tool abstract UNIX domain socket Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 through 3.2.4; 3.3.0 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2026-5774 | 6.4 | Apr 10 | Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map Affected: 2.0.0 before 2.9.57; 3.0.0 before 3.6.21; 4.0.0 before 4.0.6 |
| CVE-2024-8038 | 5.5 | Oct 2 | Vulnerable juju introspection abstract UNIX domain socket Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 through 3.2.4; 3.3 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2026-32691 | 5.3 | Mar 18 | Timing ownership claim attack on new external back-end secrets Affected: 3.0.0 before 3.6.19 |
| CVE-2025-68152 | 4.9 | Apr 3 | Juju: Read All Controller Logs From Compromised Workload Affected: 2.9 through 2.9.55; 3.6 through 3.6.18 |
| CVE-2023-0092 | 4.9 | Jan 31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem Affected: 2.9.22 before 2.9.38; 3.0.0 before 3.0.3 |
Showing 12