JU
Product
juju
21
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 2High 5Medium 12Low 2
Watch
Add juju to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4370 | 10.0 | Apr 1 | Improper TLS Client/Server authentication and certificate verification on Database Cluster Affected: 3.2.0 before 3.6.20; 4.0 before 4.0.4 |
| CVE-2017-9232 | 9.8 | May 28 | Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the… Affected: through 1.25.12; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +32 more |
| CVE-2026-32693 | 8.8 | Mar 18 | Unauthorized access to Kubernetes secrets in Juju Affected: 3.0.0 before 3.6.19 |
| CVE-2025-0928 | 8.8 | Jul 8 | Arbitrary executable upload via authenticated endpoint Affected: 2.0.0 before 2.9.52; 3.0.0 before 3.6.8 |
| CVE-2024-7558 | 8.0 | Oct 2 | JUJU_CONTEXT_ID is a predictable authentication secret Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 before 3.2.4; 3.3.0 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2015-1316 | 7.5 | Apr 22 | Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key Affected: before 1.25.5 |
| CVE-2026-93336 | 7.1 | Oct 22 | Missing authorization in the unit resources download route in Juju controllers Affected: 4.0 before 4.0.16 |
| CVE-2026-32694 | 6.6 | Mar 18 | Insecure Direct Object Reference attack via predictable secret ID in Juju Affected: 3.0.0 before 3.6.19 |
| CVE-2026-5412 | 6.5 | Apr 10 | Juju CloudSpec API could leak senstive information Affected: 2.9.0 before 2.9.57; 3.6.0 before 3.6.21 |
| CVE-2025-68153 | 6.5 | Apr 3 | Juju: Resource poisoning Affected: 2.9 through 2.9.55; 3.6 through 3.6.18 |
| CVE-2026-32692 | 6.5 | Mar 18 | Unauthorized update of out-of-scope Vault secrets Affected: 3.1.6 before 3.6.19 |
| CVE-2025-53513 | 6.5 | Jul 8 | Zip slip vulnerability in Juju Affected: 2.0.0 before 2.9.52; 3.0.0 before 3.6.8 |
| CVE-2025-53512 | 6.5 | Jul 8 | Sensitive log retrieval in Juju Affected: 2.0.0 before 2.9.52; 3.0.0 before 3.6.8 |
| CVE-2024-8037 | 6.5 | Oct 2 | Vulnerable juju hook tool abstract UNIX domain socket Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 through 3.2.4; 3.3.0 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2026-5774 | 6.4 | Apr 10 | Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map Affected: 2.0.0 before 2.9.57; 3.0.0 before 3.6.21; 4.0.0 before 4.0.6 |
| CVE-2024-8038 | 5.5 | Oct 2 | Vulnerable juju introspection abstract UNIX domain socket Affected: before 2.9.51; 3.1.0 before 3.1.10; 3.2.0 through 3.2.4; 3.3 before 3.3.7; 3.4 before 3.4.6; 3.5.0 before 3.5.4 |
| CVE-2026-32691 | 5.3 | Mar 18 | Timing ownership claim attack on new external back-end secrets Affected: 3.0.0 before 3.6.19 |
| CVE-2025-68152 | 4.9 | Apr 3 | Juju: Read All Controller Logs From Compromised Workload Affected: 2.9 through 2.9.55; 3.6 through 3.6.18 |
| CVE-2023-0092 | 4.9 | Jan 31 | An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem Affected: 2.9.22 before 2.9.38; 3.0.0 before 3.0.3 |
| CVE-2024-6984 | 3.8 | Jul 29 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation… Affected: 2.9 before 2.9.50; 3.1 before 3.1.9; 3.3 before 3.3.6; 3.4 before 3.4.5; 3.5 before 3.5.3 |
| CVE-2026-1237 | 2.1 | Jan 28 | Vulnerable cross-model authorization in juju Affected: 0 |
Showing 21