CVE-2025-68153
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Juju versions from 2.9 to before 2.9.56 and 3.6 to before 3.6.19 allow any authenticated user, machine, or controller to modify application resources across the entire controller.
Risk Assessment
Attackers can unauthorizedly change application configurations, potentially causing service disruption or privilege escalation.
Recommendation
Update Juju to versions 2.9.56 or 3.6.19, which include a fix restricting resource modifications.
Original NVD description (English source)
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.