CVE-2025-68152

MediumCVSS 4.9/10Last modified Jul 24, 2026

Description

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju controller can read any log file for any entity in any model at any level. This issue has been patched in versions 2.9.56 and 3.6.19.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Apr 3, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-681536.5Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through sp CVE-2025-681548.1systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminforma CVE-2025-681557.5@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Prior to version 0.5.8, the `/__vite_rsc_findSourceMapURL` endpoi CVE-2025-681567.5Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including `flat CVE-2025-681573.7Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpU CVE-2025-681588.8Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token CVE-2025-68163.3A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5O__fsinfo_encode of the file /CVE-2025-681604.7Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes ca CVE-2025-681614.8The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificat CVE-2025-681622.7In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration CVE-2025-681634.8In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page CVE-2025-681642.7In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test