Juju EUVD-2025-209209

The CVSS v4.0 score of 6.9 reflects high confidentiality impact (VC:H) with a network attack vector but high privilege requirement (PR:H). The EPSS exploitation probability and KEV status are not provided in the input data. The attack complexity is low (AC:L) and requires no user interaction (UI:N), making exploitation straightforward once privilege is obtained. The real-world risk is moderate-to-high: an attacker must first compromise a workload machine (requiring separate initial access), but once that foothold exists, lateral movement to read privileged logs across the entire Juju deployment is trivial. The affected versions span two major release lines (2.9.x and 3.6.x), suggesting a systemic authorization bypass rather than a narrow edge case. Organizations with multi-tenant Juju deployments or sensitive operational logs face significant risk from insider threats or supply-chain compromises targeting workload machines.

An attacker gains control of a Juju-managed workload machine through supply-chain compromise, misconfigured credentials, or lateral movement within the target infrastructure. Once on the machine, the attacker leverages the authorization bypass to query the Juju controller's log API without proper checks, reading sensitive logs from other models and entities-such as database credentials, API tokens, or operational secrets logged elsewhere in the deployment. This enables rapid escalation to sensitive systems or exfiltration of confidential data across the entire Juju management plane.