CVE-2025-68152
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Juju from versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19 allows a compromised workload machine to read any log file for any entity in any model at any level.
Risk Assessment
An attacker controlling a compromised workload machine can access sensitive log data, potentially leading to information disclosure or further privilege escalation.
Recommendation
Update Juju to version 2.9.56 or 3.6.19, which contain the fix.
Original NVD description (English source)
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.