Juju CVE-2024-8038

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate pe

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent bina

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on t

JUJU_CONTEXT_ID is a predictable authentication secret. Rated high severity (CVSS 8.0), this vulnerability is low attack

The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access deb

Unauthenticated remote database cluster compromise in Canonical Juju (versions 3.2.0-3.6.19 and 4.0-4.0.4) allows comple

Authorization bypass in Canonical Juju Controller facade allows authenticated users to extract bootstrap cloud credentia

An authorization bypass vulnerability in Canonical's Juju versions 3.0.0 through 3.6.18 allows authenticated users with

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged

An authorization bypass vulnerability exists in the Vault secrets back-end implementation of Canonical's Juju orchestrat

Unauthorized resource modification in Juju application orchestration engine allows any authenticated controller user to

Juju application orchestration engine versions 2.9 to 2.9.55 and 3.6 to 3.6.18 allow a compromised workload machine to r