Juju Application Orchestration Engine Log File Exposure Vulnerability
CVE-2025-68152
6.9MEDIUM
What is CVE-2025-68152?
A flaw in Juju, an open source application orchestration engine, allows compromised machines to access log files across any model under the Juju controller. This issue potentially exposes sensitive information, as unprivileged workloads can read logs belonging to any entity. The vulnerability affects versions 2.9 up to 2.9.55 and 3.6 up to 3.6.18, but has been addressed in subsequent updates (2.9.56 and 3.6.19). Users are encouraged to update their systems to mitigate this risk.
Affected Version(s)
juju >= 2.9, < 2.9.56 < 2.9, 2.9.56
juju >= 3.6, < 3.6.19 < 3.6, 3.6.19