CVE-2025-68152 Canonical CVE debrief

Who should care

Users of Juju versions 2.9 to 2.9.55 and 3.6 to 3.6.18 should apply patches to prevent log file exposure. This includes operators, platform administrators, vulnerability management teams, and security teams who manage Juju deployments. They should review and restrict access to log files, monitor for suspicious activity on workload machines, and ensure that log files are properly restricted.

Technical summary

The vulnerability allows a compromised workload machine under a Juju controller to access log files of any entity in any model at any level due to inadequate access controls on log files. This issue is addressed in Juju versions 2.9.56 and 3.6.19. Affected users should apply patches to upgrade Juju to a secure version and review access to log files. The exposure of sensitive information is possible if log files contain sensitive data. Users should verify the patch levels of their Juju deployments and review access to log files for any entity in any model. Additional verification tasks include checking for suspicious activity on workload machines and ensuring that log files are properly restricted. The CVE record and NVD detail provide information on the vulnerability and affected versions.

Defensive priority

Medium priority due to the potential for sensitive information disclosure.

Recommended defensive actions

• Apply patches to upgrade Juju to version 2.9.56 or 3.6.19
• Review and restrict access to log files
• Monitor for suspicious activity on workload machines
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability and affected versions. However, the scope of potentially exposed log files and entities is extensive, given the access controls in place. Defenders should verify the patch levels of their Juju deployments and review access to log files for any entity in any model. Additional verification tasks include checking for suspicious activity on workload machines and ensuring that log files are properly restricted.

Official resources