Canonical Juju vulnerabilities

• canonical juju Missing authorization in the unit resources download route in Juju controllers CVE-2026-93336 7.1 HighOctober 22, 2026
• canonical juju Juju CloudSpec API could leak senstive information CVE-2026-5412 Fix available 9.9 CriticalApril 10, 2026
• canonical juju Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map CVE-2026-5774 Fix available 6.1 MediumApril 10, 2026
• canonical juju Juju: Resource poisoning CVE-2025-68153 Fix available 7.1 HighApril 3, 2026
• canonical juju Juju: Read All Controller Logs From Compromised Workload CVE-2025-68152 Fix available 6.9 MediumApril 3, 2026
• canonical juju Improper TLS Client/Server authentication and certificate verification on Database Cluster CVE-2026-4370 10.0 CriticalApril 1, 2026
• canonical juju Insecure Direct Object Reference attack via predictable secret ID in Juju CVE-2026-32694 Fix available 6.6 MediumMarch 18, 2026
• canonical juju Unauthorized access to Kubernetes secrets in Juju CVE-2026-32693 Fix available 8.8 HighMarch 18, 2026
• canonical juju Unauthorized update of out-of-scope Vault secrets CVE-2026-32692 Fix available 7.6 HighMarch 18, 2026
• canonical juju Timing ownership claim attack on new external back-end secrets CVE-2026-32691 Fix available 5.3 MediumMarch 18, 2026
• canonical juju Juju has broken CMR authorization CVE-2026-1237 2.1 LowJanuary 28, 2026
• canonical juju Arbitrary executable upload via authenticated endpoint CVE-2025-0928 Fix available 8.8 HighJuly 8, 2025
• canonical juju Zip slip vulnerability in Juju CVE-2025-53513 Fix available 8.8 HighJuly 8, 2025
• canonical juju Sensitive log retrieval in Juju CVE-2025-53512 Fix available 6.5 MediumJuly 8, 2025
• canonical juju utils, juju\/utils +1 more Key leakage in juju/utils certificates CVE-2025-6224 Fix available 6.5 MediumJuly 1, 2025
• canonical juju Vulnerable juju introspection abstract UNIX domain socket CVE-2024-8038 Fix available 7.9 HighOctober 2, 2024
• canonical juju Vulnerable juju hook tool abstract UNIX domain socket CVE-2024-8037 Fix available 6.5 MediumOctober 2, 2024
• canonical juju JUJU_CONTEXT_ID is a predictable authentication secret CVE-2024-7558 Fix available 8.7 HighOctober 2, 2024
• canonical juju Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm CVE-2024-6984 Fix available 8.8 HighJuly 29, 2024
• canonical juju Juju controller - Arbitrary file reading vulnerability CVE-2023-0092 Fix available 4.9 MediumMarch 1, 2023
• canonical juju Juju Joyent provider uploads user's private ssh key by default CVE-2015-1316 6.4 MediumApril 22, 2019
• canonical juju Juju uses a UNIX domain socket without setting appropriate permissions CVE-2017-9232 Public exploitFix available EPSS 48.5% 9.8 CriticalMay 26, 2017