6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53512

CVE-2025-53512: Sensitive log retrieval in Juju

The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53512

CVE-2025-53512:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/juju/juju	go	< 0.0.0-20250619024904-402ff008dcc2	0.0.0-20250619024904-402ff008dcc2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper authorization of the /log endpoint in the Juju API server. Any authenticated user could access this endpoint and read debug logs, which could contain sensitive information. The root cause of this issue was the weak authorization configuration within the apiserver.Server.endpoints function.

The analysis of the provided patches (commits 402ff008dcc2cb57f4441968628637efb5c2a662 and c91a1f4046956874ba77c8b398aecee3d61a2dc3) reveals that the endpoints function was modified to enforce stricter access control. Specifically, the original implementation used a tagKindAuthorizer that only verified that the user was authenticated, but did not perform any permission checks for accessing logs.

The fix, as seen in the patches, was to introduce a CompositeAuthorizer for the debugLogHandler. This new authorizer combines the existing tagKindAuthorizer (now restricted to machine and controller agents) with a modelPermissionAuthorizer. This new authorizer ensures that any user attempting to access the /log endpoint must have permission.ReadAccess on the model, effectively preventing unauthorized users from reading the logs.

Therefore, the apiserver.(*Server).endpoints function is identified as the vulnerable function because it was responsible for the insecure configuration of the /log endpoint's authorization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.