{"id":"CVE-2025-53512","aliases":["EUVD-2025-20674","GHSA-r64v-82fh-xc63","GO-2025-3806","openSUSE-SU-2025:15405-1"],"status":"published","title":"Sensitive log retrieval in Juju","description":"The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00378,"percentile":0.32085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-285"],"published":"2025-07-08T16:47:44Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"Go","package":"github.com/juju/juju","fixed_in":["0.0.0-20250619024904-402ff008dcc2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/juju/juju","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20250619024904-402ff008dcc2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/juju/juju","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250619024904-402ff008dcc2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/juju/juju","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250619024904-402ff008dcc2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250730T213748-1.1"}]}],"bundled":56}],"products":[{"vendor":"canonical","product":"juju"}],"references":[{"url":"https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63","tags":["Exploit","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53512","tags":["advisory"]},{"url":"https://github.com/juju/juju/commit/402ff008dcc2cb57f4441968628637efb5c2a662","tags":["web","fix"]},{"url":"https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-r64v-82fh-xc63"},{"url":"https://juju.is/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53512.json","tags":["advisory"]},{"url":"https://github.com/juju/juju","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-51471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6624","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-53512","title":"Sensitive log retrieval in Juju","description":"The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.","status":"published","published":"2025-07-08T16:47:44.427Z","modified":"2025-07-08T19:09:24.844Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-285"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-20674","description":"The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.","status":"published","published":"2025-07-08T16:47:44Z","modified":"2025-07-08T19:09:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:11.045947Z"}],"ghsa":[{"id":"GHSA-r64v-82fh-xc63","title":"Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization","description":"### Impact\nAny user with a Juju account on a controller can read debug log messages from the `/log` endpoint.\nNo specific permissions are required - it's just sufficient for the user to exist in the controller user database.\nThe log messages may contain sensitive information.\n\n### Details\n\nThe `/log` endpoint is accessible at the following endpoints:\n- `wss://\u003ccontroller-ip\u003e/log`\n- `wss://\u003ccontroller-ip\u003e/model/\u003cmodel-uuid\u003e/log`\n\nIn order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\nRun the [wscat](https://github.com/websockets/wscat) command below to\nconnect to `wss://\u003ccontroller-ip\u003e:17070/api`. Update the JSON payload to include the username and password that were created above.\n\n```\nwscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api\n{ \"type\": \"Admin\", \"request\": \"Login\", \"version\": 3, \"params\": { \"client-\nversion\": \"3.6.1.0\", \"auth-tag\": \"user-testuser\", \"credentials\": \"\npassword\" } }\n```\n\nObserve that the connection fails due to a lack of permissions.\n\nRun the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.\n\n```\nwscat --auth user-testuser:password -H \"X-Juju-ClientVersion: 3.6.4\" --no-check -c wss://\u003ccontroller-ip\u003e:17070/log\n```\n\nObserve that the logs are returned in the server’s response.\n\n### Code\n\nThe `/log` handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no workarounds.\n\n### References\n[F-01](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)","status":"published","published":"2025-07-09T15:30:58Z","modified":"2025-07-09T15:31:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2025-53512","description":"The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.","status":"published","published":"2025-07-08T17:16:04.4Z","modified":"2026-06-17T09:38:21.513Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-285"],"updated_at":"2026-11-02T14:11:17.727956Z"}],"osv":[{"id":"CVE-2025-53512","title":"Sensitive log retrieval in Juju","description":"The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.","status":"published","published":"2025-07-08T16:47:44.427Z","modified":"2026-10-28T02:30:20.568404888Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-285"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"GHSA-r64v-82fh-xc63","title":"Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization","description":"### Impact\nAny user with a Juju account on a controller can read debug log messages from the `/log` endpoint.\nNo specific permissions are required - it's just sufficient for the user to exist in the controller user database.\nThe log messages may contain sensitive information.\n\n### Details\n\nThe `/log` endpoint is accessible at the following endpoints:\n- `wss://\u003ccontroller-ip\u003e/log`\n- `wss://\u003ccontroller-ip\u003e/model/\u003cmodel-uuid\u003e/log`\n\nIn order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\nRun the [wscat](https://github.com/websockets/wscat) command below to\nconnect to `wss://\u003ccontroller-ip\u003e:17070/api`. Update the JSON payload to include the username and password that were created above.\n\n```\nwscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api\n{ \"type\": \"Admin\", \"request\": \"Login\", \"version\": 3, \"params\": { \"client-\nversion\": \"3.6.1.0\", \"auth-tag\": \"user-testuser\", \"credentials\": \"\npassword\" } }\n```\n\nObserve that the connection fails due to a lack of permissions.\n\nRun the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.\n\n```\nwscat --auth user-testuser:password -H \"X-Juju-ClientVersion: 3.6.4\" --no-check -c wss://\u003ccontroller-ip\u003e:17070/log\n```\n\nObserve that the logs are returned in the server’s response.\n\n### Code\n\nThe `/log` handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no workarounds.\n\n### References\n[F-01](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)","status":"published","published":"2025-07-09T15:30:58Z","modified":"2025-07-28T20:42:15.788089Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"GO-2025-3806","title":"Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju","description":"Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju","status":"published","published":"2025-07-28T19:57:13Z","modified":"2026-03-03T04:57:21.905614Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15405-1","title":"govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-04T00:00:00Z","modified":"2026-03-23T04:53:44.42671Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}