Skip to content
OpenAdvisories

Package · Go

github.com/juju/juju

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-5412

    Juju CloudSpec API could leak senstive information

    In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user t…

    Canonical Juju github.com/juju/juju Go
  • Critical 10.0
    CVE-2026-4370

    Improper TLS Client/Server authentication and certificate verification on Database Cluster

    A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endp…

    Canonical Juju github.com/juju/juju Go
  • Critical 9.8
    CVE-2017-9232 Public exploit EPSS 49%

    Juju uses a UNIX domain socket without setting appropriate permissions

    Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

    github.com/juju/juju juju-core juju-core-1 Ubuntu Go