CVE-2025-53512: Canonical Juju Information Disclosure Flaw

CVE-2025-53512 Overview

CVE-2025-53512 is an information disclosure vulnerability in Canonical Juju, an open-source application modeling and orchestration tool. The /log endpoint on a Juju controller failed to enforce sufficient authorization checks. Authenticated users without appropriate privileges could stream debug log messages from the controller. These debug messages can contain sensitive operational data, credentials, or configuration details. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged authenticated users can access controller debug logs that may contain secrets, tokens, and sensitive orchestration data across managed models.

Affected Products

Canonical Juju controller (see GitHub Security Advisory GHSA-r64v-82fh-xc63 for exact version ranges)
Juju-managed environments where multiple users share a controller
Deployments exposing the controller API endpoint to authenticated tenants

Discovery Timeline

2025-07-08 - CVE-2025-53512 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53512

Vulnerability Analysis

Juju controllers expose an HTTP /log endpoint that streams internal debug messages from the controller and its managed models. The endpoint authenticated the caller but did not verify that the caller held the permissions required to read those log streams. Any user with valid credentials to the controller could subscribe to the stream regardless of their model role.

Debug logs frequently contain operational details useful to an attacker performing reconnaissance. Examples include model names, unit identifiers, agent state transitions, error traces with stack frames, and in some cases secrets accidentally logged by charms or hooks. This maps to CWE-200, information exposure to an unauthorized actor.

Root Cause

The root cause is a missing authorization check on the /log HTTP handler. Authentication established the user's identity, but the handler did not consult the controller's permission model before establishing the log subscription. This is a classic broken access control pattern where authentication was conflated with authorization.

Attack Vector

An attacker requires network access to the Juju controller API and valid low-privilege credentials such as a login for any model on the controller. The attacker then connects to the /log WebSocket endpoint and receives the debug stream. No user interaction is required, and the attack complexity is low. The vulnerability affects confidentiality only; integrity and availability are unchanged.

Refer to the official Juju security advisory for technical specifics on the affected handler and fix.

Detection Methods for CVE-2025-53512

Indicators of Compromise

Unexpected WebSocket connections to the /log path on controller API ports from user accounts that do not administer models
Long-lived authenticated sessions from accounts whose normal workflow does not include log streaming
Access log entries showing repeated /log subscriptions correlated with reconnaissance activity elsewhere

Detection Strategies

Enable and centralize Juju controller audit logs, then alert on /log endpoint access by non-administrator principals
Correlate controller API access patterns with user role assignments to surface authorization anomalies
Baseline normal log subscribers per environment and alert on new consumers of the debug stream

Monitoring Recommendations

Forward controller and reverse-proxy access logs to a SIEM for retention and query
Track authentication events for all controller users and flag rare or first-time /log access
Review charm and hook code for accidental secret logging so exposure is minimized even if access controls fail

How to Mitigate CVE-2025-53512

Immediate Actions Required

Upgrade Juju controllers to the fixed release identified in GHSA-r64v-82fh-xc63
Audit controller user accounts and remove access for principals that no longer require it
Rotate any credentials, tokens, or secrets that may have appeared in controller debug logs

Patch Information

Canonical published the fix through the Juju GitHub Security Advisory GHSA-r64v-82fh-xc63. The patch introduces authorization checks on the /log endpoint so that only users with sufficient permissions can subscribe to the debug stream. Operators should consult the advisory for the exact fixed version corresponding to their release train.

Workarounds

Restrict network access to the controller API port so only trusted operators can reach it
Reduce the number of users granted controller login rights until the patch is applied
Configure charms and applications to avoid emitting secrets into debug logs as a defense-in-depth measure

bash

# Verify installed Juju controller version and upgrade
juju version
juju upgrade-controller --agent-version <patched-version>