CVE-2025-68152

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68152
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68152.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-68152
Aliases
Downstream
Related
Published
2026-04-03T15:25:56Z
Modified
2026-08-25T04:02:15Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Juju: Read All Controller Logs From Compromised Workload
Details

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68152.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.9"
                },
                {
                    "fixed": "2.9.56"
                },
                {
                    "introduced": "3.6"
                },
                {
                    "fixed": "3.6.19"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "2.9.56"
                },
                {
                    "fixed": "3.6.19"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/juju/juju

Affected ranges

Type
GIT
Repo
https://github.com/juju/juju
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
22cdcf6b54c2f371822e1c203d4f341be6c9589e
Fixed
c91a1f4046956874ba77c8b398aecee3d61a2dc3
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

Other
delete-ecs
juju-1.*
juju-1.19.3
juju-1.19.4
juju-1.21-alpha1
juju-1.21-alpha2
juju-1.21-alpha3
juju-1.25-alpha1
juju-1.26-alpha1
juju-1.26-alpha2
juju-1.26-alpha3
juju-2.*
juju-2.0-alpha1
juju-2.0-alpha2
juju-2.0-beta1
juju-2.0-beta10
juju-2.0-beta11
juju-2.0-beta12
juju-2.0-beta13
juju-2.0-beta14
juju-2.0-beta15
juju-2.0-beta16
juju-2.0-beta17
juju-2.0-beta18
juju-2.0-beta2
juju-2.0-beta3
juju-2.0-beta4
juju-2.0-beta5
juju-2.0-beta6
juju-2.0-beta7
juju-2.0-beta8
juju-2.0-beta9
juju-2.0-rc1
juju-2.0-rc2
juju-2.0-rc3
juju-2.0.0
juju-2.1-beta1
juju-2.1-beta2
juju-2.2-alpha1
juju-2.2-beta1
juju-2.2-beta2
juju-2.2-beta3
juju-2.2-beta4
juju-2.2-rc1
juju-2.3-beta1
juju-2.3-beta2
juju-2.3-beta3
juju-2.3-rc1
juju-2.3-rc2
juju-2.4-beta1
juju-2.4-beta2
juju-2.4-beta3
juju-2.4-rc1
juju-2.5-beta1
juju-2.5-beta2
juju-2.5-beta3
juju-2.6-beta1
juju-2.6-beta2
juju-2.6-rc1
juju-2.7-beta1
juju-2.7-rc1
juju-2.8-beta1
juju-2.8-rc1
juju-2.9-beta1
juju-2.9-rc1
juju-2.9-rc2
juju-2.9.45
juju-2.9.46
juju-3.*
juju-3.0-beta1
juju-3.0-beta2
juju-3.0-beta3
juju-3.0-beta4
juju-3.0-rc1
juju-3.1.6
juju-3.2-beta1
juju-3.2.3
juju-3.2.4
juju-3.3-beta1
juju-3.3.0
v3.*
v3.3-beta2
v3.3-rc1
v3.3-rc2
v3.3.0
v3.4-beta1
v3.4-rc1
v3.5-beta1
v3.6-beta1
v3.6-beta2
v3.6-rc1
v3.6-rc2
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68152.json"