CVE-2025-68153

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68153
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68153.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-68153
Aliases
Downstream
Related
Published
2026-04-03T15:28:06.191Z
Modified
2026-08-05T03:32:10.656940439Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Juju: Resource poisoning
Details

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju controller can modify the resources of an application within the entire controller. This issue has been patched in versions 2.9.56 and 3.6.19.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68153.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.9"
                },
                {
                    "fixed": "2.9.56"
                },
                {
                    "introduced": "3.6"
                },
                {
                    "fixed": "3.6.19"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "2.9.56"
                },
                {
                    "fixed": "3.6.19"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/juju/juju

Affected ranges

Type
GIT
Repo
https://github.com/juju/juju
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26ff93c903d55b0712c6fb3f6b254710edb971d4
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

Other
juju-
juju-1.*
juju-1.19.3
juju-1.19.4
juju-1.21-alpha1
juju-1.21-alpha2
juju-1.21-alpha3
juju-1.25-alpha1
juju-1.26-alpha1
juju-1.26-alpha2
juju-1.26-alpha3
juju-2.*
juju-2.0-alpha1
juju-2.0-alpha2
juju-2.0-beta1
juju-2.0-beta10
juju-2.0-beta11
juju-2.0-beta12
juju-2.0-beta13
juju-2.0-beta14
juju-2.0-beta15
juju-2.0-beta16
juju-2.0-beta17
juju-2.0-beta18
juju-2.0-beta2
juju-2.0-beta3
juju-2.0-beta4
juju-2.0-beta5
juju-2.0-beta6
juju-2.0-beta7
juju-2.0-beta8
juju-2.0-beta9
juju-2.0-rc1
juju-2.0-rc2
juju-2.0-rc3
juju-2.0.0
juju-2.1-beta1
juju-2.1-beta2
juju-2.2-alpha1
juju-2.2-beta1
juju-2.2-beta2
juju-2.2-beta3
juju-2.2-beta4
juju-2.2-rc1
juju-2.3-beta1
juju-2.3-beta2
juju-2.3-beta3
juju-2.3-rc1
juju-2.3-rc2
juju-2.4-beta1
juju-2.4-beta2
juju-2.4-beta3
juju-2.4-rc1
juju-2.5-beta1
juju-2.5-beta2
juju-2.5-beta3
juju-2.6-beta1
juju-2.6-beta2
juju-2.6-rc1
juju-2.7-beta1
juju-2.7-rc1
juju-2.8-beta1
juju-2.8-rc1
juju-2.9-beta1
juju-2.9-rc1
juju-2.9-rc10
juju-2.9-rc11
juju-2.9-rc12
juju-2.9-rc2
juju-2.9-rc3
juju-2.9-rc4
juju-2.9-rc5
juju-2.9-rc6
juju-2.9-rc7
juju-2.9-rc8
juju-2.9-rc9
juju-2.9.0
juju-2.9.1
juju-2.9.10
juju-2.9.11
juju-2.9.12
juju-2.9.13
juju-2.9.14
juju-2.9.15
juju-2.9.16
juju-2.9.17
juju-2.9.18
juju-2.9.19
juju-2.9.2
juju-2.9.20
juju-2.9.21
juju-2.9.22
juju-2.9.23
juju-2.9.24
juju-2.9.25
juju-2.9.26
juju-2.9.27
juju-2.9.28
juju-2.9.29
juju-2.9.3
juju-2.9.30
juju-2.9.31
juju-2.9.32
juju-2.9.33
juju-2.9.34
juju-2.9.35
juju-2.9.36
juju-2.9.37
juju-2.9.38
juju-2.9.39
juju-2.9.4
juju-2.9.40
juju-2.9.41
juju-2.9.42
juju-2.9.43
juju-2.9.44
juju-2.9.5
juju-2.9.6
juju-2.9.7
juju-2.9.8
juju-2.9.9
v2.*
v2.9.45
v2.9.46
v2.9.47
v2.9.48
v2.9.49
v2.9.53

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68153.json"