Juju EUVD-2025-209211

Attacker must possess valid authenticated credentials to the Juju controller-either user credentials, machine agent credentials, or compromised controller component identity. The vulnerability does not affect unauthenticated or anonymous access. Exploitation is limited to the scope of a single Juju controller instance; attackers cannot cross controller boundaries. Affected versions must be 2.9.0-2.9.55 or 3.6.0-3.6.18. No special Juju features, non-default configurations, or specific charm deployments are required-the flaw exists in core authorization logic affecting standard resource modification operations. What limits exploitation: authentication requirement (PR:L) means initial credential compromise or malicious insider scenario is prerequisite. Network reachability to controller API (typically TCP 17070) is necessary but not sufficient. Impact scope is limited to integrity (VI:H)-attackers can modify resources but cannot directly exfiltrate data (VC:N) or cause availability disruption (VA:N) through this vulnerability alone.

Medium-high risk for Juju deployments with multiple tenants or untrusted authenticated users, but low immediate exploitation likelihood. CVSS 7.1 (High) reflects significant integrity impact (VI:H) with network-accessible attack vector (AV:N) and low complexity (AC:L). However, low privilege authentication requirement (PR:L) substantially narrows the attack surface-adversaries need valid credentials first. EPSS score of 0.01% (2nd percentile) indicates security researchers assess mass exploitation as highly unlikely, suggesting this is a targeted risk rather than wormable threat. No CISA KEV listing confirms no known active exploitation. SSVC assessment: exploitation status is none (no public POC identified), automatable is no (requires pre-existing authentication), technical impact is partial (integrity only, no confidentiality/availability impact per CVSS vector VC:N/VA:N). Real-world risk concentrates in multi-tenant Juju environments or scenarios where machine/controller compromise could pivot to application resource tampering. Single-tenant deployments with trusted authenticated users face minimal practical risk. Authentication prerequisite and low EPSS score suggest prioritization below remotely exploitable unauthenticated vulnerabilities, but organizations running Juju 2.9 or 3.6 branches should patch during normal maintenance windows.

An attacker compromises credentials for a low-privilege Juju user account (e.g., read-only user, monitoring service account, or machine agent). Using authenticated API access to the Juju controller, the attacker issues resource modification commands targeting applications in other models or owned by other users within the same controller. Due to the authorization bypass, the controller accepts these operations despite the attacker lacking appropriate permissions. The attacker modifies application charm resources-such as configuration files, container images, or binaries-to inject backdoors, alter application behavior, or disrupt services. Network accessibility (AV:N) and low complexity (AC:L) mean exploitation requires only valid credentials and standard Juju client tools.