- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/13/2026, Juju recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Juju and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-93336Missing authorization in the unit resources download route in Juju controllersCVE-2026-5774Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token MapCVE-2026-5412Juju CloudSpec API could leak senstive informationCVE-2026-4370Improper TLS Client/Server authentication and certificate verification on Database ClusterCVE-2026-32694Insecure Direct Object Reference attack via predictable secret ID in Juju| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-93336Missing authorization in the unit resources download route in Juju controllers | Exploitation statusNot exploited | FixYes | Published10/22/2026 | SeverityHigh |
CVE-2026-5774Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map | Exploitation statusActively exploited | FixYes | Published04/10/2026 | SeverityMedium |
CVE-2026-5412Juju CloudSpec API could leak senstive information | Exploitation statusNot exploited | FixYes | Published04/10/2026 | SeverityCritical |
CVE-2026-4370Improper TLS Client/Server authentication and certificate verification on Database Cluster | Exploitation statusActively exploited | FixYes | Published04/01/2026 | SeverityCritical |
CVE-2026-32694Insecure Direct Object Reference attack via predictable secret ID in Juju | Exploitation statusActively exploited | FixYes | Published03/18/2026 | SeverityMedium |
CVE-2026-32693Unauthorized access to Kubernetes secrets in Juju | Exploitation statusNot exploited | FixYes | Published03/18/2026 | SeverityHigh |
CVE-2026-32692Unauthorized update of out-of-scope Vault secrets | Exploitation statusNot exploited | FixYes | Published03/18/2026 | SeverityHigh |
CVE-2026-32691Timing ownership claim attack on new external back-end secrets | Exploitation statusNot exploited | FixYes | Published03/18/2026 | SeverityMedium |
CVE-2026-1237CVE-2026-1237 | Exploitation statusNot exploited | FixNo | Published01/28/2026 | SeverityLow |
CVE-2025-53513Zip slip vulnerability in Juju | Exploitation statusActively exploited | FixYes | Published07/08/2025 | SeverityHigh |
CVE-2025-53512Sensitive log retrieval in Juju | Exploitation statusActively exploited | FixYes | Published07/08/2025 | SeverityMedium |
CVE-2025-0928Arbitrary executable upload via authenticated endpoint | Exploitation statusActively exploited | FixYes | Published07/08/2025 | SeverityHigh |
12 Results | Page 1 of 1