PT-2025-28503

Name of the Vulnerable Software and Affected Versions: Juju versions prior to 3.6.8 Juju versions prior to 2.9.52 Description: The issue allows any authenticated controller user to upload arbitrary agent binaries to any model or to the controller itself without verifying model membership or...

PT-2025-28633

Name of the Vulnerable Software and Affected Versions: Juju affected versions not specified Description: The issue concerns the "/log" endpoint on a Juju controller, which lacked sufficient authorization checks. This allowed unauthorized users to access debug messages that could contain sensitive...

Privilege Escalation

github.com/juju/juju is vulnerable to a privilege escalation. The vulnerability is due to the use of a predictable JUJUCONTEXTID as an authentication secret, allows an unprivileged user in the same network namespace to guess the ID and connect to the abstract domain socket...