Canonical Juju is affected by an authorization bypass vulnerability that allows authenticated users to execute arbitrary code on controller or model machines.

The vulnerability is an improper authorization flaw (CWE-285) where an authenticated controller user can upload arbitrary agent binaries without verifying model membership or required permissions. This allows for the distribution of malicious binaries to machines during upgrade or deployment cycles.

Successful exploitation allows an authenticated attacker to achieve remote code execution on the Juju controller or managed models. Given the CVSS score of 8.8, this represents a high risk to infrastructure integrity and confidentiality. Compromise of the Juju controller grants the attacker significant control over the cloud environment and orchestrated services, potentially leading to a total system takeover.

Immediate Action: Update all Juju installations to version 2.9.52, 3.6.8, or the latest available patched release provided by Canonical.

Proactive Monitoring: Review audit logs for unauthorized binary uploads or unexpected modifications to agent deployment configurations. Monitor controller logs for unusual authentication patterns originating from standard user accounts.

Compensating Controls: Restrict access to the Juju controller API to trusted internal networks only. Implement strict role-based access control to limit which users have permission to manage models or perform administrative tasks.

Public Exploit Available: exploit_available (unknown)

This vulnerability presents a significant risk to the security of orchestrated environments managed by Juju. Administrators should prioritize the application of security patches to all affected controller instances immediately. Failure to update may allow an authenticated user to escalate privileges and gain unauthorized control over the entire managed infrastructure.