Juju security vulnerabilities

Juju is a publicly available application orchestration engine developed by Canonical Juju. There is a security vulnerability in Juju, which stems from a flaw in cross-model authorization. This vulnerability could allow malicious users to maintain privileges that have been revoked or expired...

CVE-2024-41129

The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of the args via CLI. This issue may affect any of the charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processi...

EUVD-2015-1457

Malware in sbrugna...

EUVD-2024-2360

Malicious code in bioql PyPI...

EUVD-2025-20670

Malicious code in bioql PyPI...

EUVD-2024-3000

Malicious code in bioql PyPI...

EUVD-2023-1139

Malicious code in bioql PyPI...

EUVD-2024-3082

Malicious code in bioql PyPI...

EUVD-2024-47965

Malicious code in bioql PyPI...

EUVD-2025-20665

Malicious code in bioql PyPI...

EUVD-2025-20674

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-6224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netwo...

SUSE CVE-2025-53512

The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information...

SUSE CVE-2025-53513

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through th...

SUSE CVE-2025-0928

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or...

SUSE CVE-2025-6224

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

GO-2025-3806 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju

Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju...

GO-2025-3804 Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju

Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju...

CVE-2025-0928

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or...

CVE-2025-53513

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through th...