{"id":"CVE-2025-53512","aliases":["GHSA-r64v-82fh-xc63","GO-2025-3806"],"url":"https://o3.security/vulnerability/CVE-2025-53512","summary":"Sensitive log retrieval in Juju","details":"### Impact\nAny user with a Juju account on a controller can read debug log messages from the `/log` endpoint.\nNo specific permissions are required - it's just sufficient for the user to exist in the controller user database.\nThe log messages may contain sensitive information.\n\n### Details\n\nThe `/log` endpoint is accessible at the following endpoints:\n- `wss://<controller-ip>/log`\n- `wss://<controller-ip>/model/<model-uuid>/log`\n\nIn order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\nRun the [wscat](https://github.com/websockets/wscat) command below to\nconnect to `wss://<controller-ip>:17070/api`. Update the JSON payload to include the username and password that were created above.\n\n```\nwscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api\n{ \"type\": \"Admin\", \"request\": \"Login\", \"version\": 3, \"params\": { \"client-\nversion\": \"3.6.1.0\", \"auth-tag\": \"user-testuser\", \"credentials\": \"\npassword\" } }\n```\n\nObserve that the connection fails due to a lack of permissions.\n\nRun the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.\n\n```\nwscat --auth user-testuser:password -H \"X-Juju-ClientVersion: 3.6.4\" --no-check -c wss://<controller-ip>:17070/log\n```\n\nObserve that the logs are returned in the server’s response.\n\n### Code\n\nThe `/log` handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no workarounds.\n\n### References\n[F-01](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)","published":"2025-07-08T16:47:44.427Z","modified":"2026-08-12T03:51:25.405395815Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/juju/juju","fixedVersion":"0.0.0-20250619024904-402ff008dcc2"}],"fix":{"url":"https://github.com/juju/juju/commit/402ff008dcc2cb57f4441968628637efb5c2a662","label":"juju/juju@402ff00"},"references":[{"type":"WEB","url":"https://juju.is/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53512.json"},{"type":"ADVISORY","url":"https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53512"},{"type":"PACKAGE","url":"https://github.com/juju/juju"},{"type":"WEB","url":"https://github.com/juju/juju/commit/402ff008dcc2cb57f4441968628637efb5c2a662"},{"type":"WEB","url":"https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:25.405395815Z"}}