Github.com/juju/juju

This hub aggregates every CVE we track for Github.com/juju/juju, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 10 most recently published vulnerabilities affecting Github.com/juju/juju.

• CVE-2026-1237Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that i...Jan 28, 2026
• CVE-2025-0928Arbitrary executable upload via authenticated endpoint8.8Jul 8, 2025
• CVE-2025-53513Zip slip vulnerability in Juju8.8Jul 8, 2025
• CVE-2025-53512Sensitive log retrieval in Juju6.5Jul 8, 2025
• CVE-2023-0092An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.4.9Jan 31, 2025
• CVE-2024-8038Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This ...7.9Oct 2, 2024
• CVE-2024-8037Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the ...6.5Oct 2, 2024
• CVE-2024-7558JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to...8.7Oct 2, 2024
• GHSA-6vjm-54vp-mxhxJuju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charmAug 5, 2024
• CVE-2017-9232Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.9.8May 28, 2017