Juju vulnerabilities

Juju versions before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 use a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Juju versions from 2.9 to before 2.9.56 and 3.6 to before 3.6.19 allow any authenticated user, machine, or controller to modify application resources across the entire controller.

Juju from versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19 allows a compromised workload machine to read any log file for any entity in any model at any level.