CVE-2023-0092: Canonical Juju

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

Affected products

• Canonical Juju: from 2.9.22, before 2.9.38 (fixed in 2.9.38); from 3.0.0, before 3.0.3 (fixed in 3.0.3)

Published 2025-01-31. Last modified 2026-06-17.