Canonical Juju vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Latest Canonical Juju vulnerabilities

CVE-2026-93336 — Missing authorization in the unit resources download route in Juju controllers (CVSS 7.1)
CVE-2026-5774 — Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map (CVSS 6.4)
CVE-2026-5412 — Juju CloudSpec API could leak senstive information (CVSS 6.5)
CVE-2025-68153 — Juju: Resource poisoning (CVSS 6.5)
CVE-2025-68152 — Juju: Read All Controller Logs From Compromised Workload (CVSS 4.9)
CVE-2026-4370 — Improper TLS Client/Server authentication and certificate verification on Database Cluster (CVSS 10.0)
CVE-2026-32694 — Insecure Direct Object Reference attack via predictable secret ID in Juju (CVSS 6.6)
CVE-2026-32693 — Unauthorized access to Kubernetes secrets in Juju (CVSS 8.8)
CVE-2026-32692 — Unauthorized update of out-of-scope Vault secrets (CVSS 6.5)
CVE-2026-32691 — Timing ownership claim attack on new external back-end secrets (CVSS 5.3)
CVE-2026-1237 — (CVSS 2.1)
CVE-2025-0928 — Arbitrary executable upload via authenticated endpoint (CVSS 8.8)
CVE-2025-53513 — Zip slip vulnerability in Juju (CVSS 6.5)
CVE-2025-53512 — Sensitive log retrieval in Juju (CVSS 6.5)
CVE-2023-0092 — (CVSS 4.9)
CVE-2024-8038 — (CVSS 5.5)
CVE-2024-8037 — (CVSS 6.5)
CVE-2024-7558 — (CVSS 8.0)
CVE-2024-6984 — (CVSS 3.8)
CVE-2015-1316 — Juju Joyent provider uploads user's private ssh key by default (CVSS 7.5)
CVE-2017-9232 — (CVSS 9.8)