CVE-2025-68153: Juju: Resource poisoning

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-863

Description

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.

Affected products

Canonical Juju: from 2.9 through 2.9.55; from 3.6 through 3.6.18

References

https://github.com/juju/juju/commit/26ff93c903d55b0712c6fb3f6b254710edb971d4
https://github.com/juju/juju/security/advisories/GHSA-245v-p8fj-vwm2

Get alerted when CVE-2025-68153 or the next vulnerability affects your stack