CVE-2025-53512
published 2025-07-08CVE-2025-53512: The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.32%
23.2th percentile
The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | juju | < 2.9.52 | 2.9.52 |
| canonical | juju | >= 2.0.0 < 2.9.52 | 2.9.52 |
| canonical | juju | >= 3.0 < 3.6.8 | 3.6.8 |
| canonical | juju | >= 3.0.0 < 3.6.8 | 3.6.8 |
| github.com | juju_juju | >= 0 < 0.0.0-20250619024904-402ff008dcc2 | 0.0.0-20250619024904-402ff008dcc2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju
osv·2025-07-28
CVE-2025-53512 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju
GHSA
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization
ghsa·2025-07-09
CVE-2025-53512 [MEDIUM] CWE-200 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization
### Impact
Any user with a Juju account on a controller can read debug log messages from the `/log` endpoint.
No specific permissions are required - it's just sufficient for the user to exist in the controller user database.
The log messages may contain sensitive information.
### Details
The `/log` endpoint is accessible at the following endpoints:
- `wss:///log`
- `wss:///model//log`
In order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.
To reproduce:
```
juju bootstr
OSV
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization
osv·2025-07-09
CVE-2025-53512 [MEDIUM] Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization
Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization
### Impact
Any user with a Juju account on a controller can read debug log messages from the `/log` endpoint.
No specific permissions are required - it's just sufficient for the user to exist in the controller user database.
The log messages may contain sensitive information.
### Details
The `/log` endpoint is accessible at the following endpoints:
- `wss:///log`
- `wss:///model//log`
In order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.
To reproduce:
```
juju bootstr
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-08
Published