CVE-2025-68153: Canonical Juju incorrect authorization in resource handler

CVE-2025-68153 · Severity: medium · CVSS 6.5 · Published 2026-04-03

Juju is an application orchestration engine used to deploy and manage software across various cloud infrastructures. A security flaw allows any authenticated user or machine on the system to modify application resources, such as container images or configuration files, across the entire controller. This could allow an attacker to replace legitimate software with malicious versions, potentially leading to data theft or full system takeover.

Technologies: Canonical Juju, github.com/juju/juju (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2025-68153 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-68153 being exploited in the wild.
How severe is CVE-2025-68153?
Medium severity, with a CVSS score of 6.5, published 3 April 2026.
Which products and versions are affected?
Canonical Juju 2.9 to 2.9.55, 3.6 to 3.6.18; github.com/juju/juju (Go) < 0.0.0-20260120044552-26ff93c903d5, SEMVER:introduced=0,fixed=0.0.0-20260120044552-26ff93c903d5.
Is there a fix for CVE-2025-68153?
Yes. github.com/juju/juju (Go): upgrade to 0.0.0-20260120044552-26ff93c903d5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68153 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-68153?
Check whether you run Canonical Juju or github.com/juju/juju (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/juju/juju (Go): upgrade to 0.0.0-20260120044552-26ff93c903d5 or later
    go get github.com/juju/juju@v0.0.0-20260120044552-26ff93c903d5

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Juju's resource handler. The handler used a single authorization check for both 'GET' and 'PUT' operations, requiring only basic authentication as a user, machine, or controller without verifying specific model-level write permissions. An attacker with valid credentials and knowledge of a target's model UUID, application name, and resource name can perform a 'PUT' request to the resource handler path. This allows the attacker to overwrite the resource cache on the controller, effectively poisoning OCI images or file resources used by other applications. The issue is fixed in versions 2.9.56 and 3.6.19 by implementing distinct permission checks for upload operations.

Affected products

  • Canonical Juju 2.9 to 2.9.55, 3.6 to 3.6.18

Identifiers

  • CVE-2025-68153
  • GHSA-245v-p8fj-vwm2
  • GO-2026-4924

Timeline

  • 2025-12-17: other: Fix authored
  • 2026-01-20: patched: Fix committed to repository
  • 2026-04-01: advisory: Vendor advisory published via GitHub
  • 2026-04-03: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.