CVE-2024-6984 Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm
A local unprivileged attacker can leak sensitive context IDs in Juju, allowing access to other sensitive data or relations accessible to the local charm.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6984?
CVE-2024-6984 is a high-severity vulnerability in Canonical Ltd. Juju, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.
Weakness: CWE-209
Which versions are affected by CVE-2024-6984?
12 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/juju Go | All versions | None |
github.com/juju/juju Go | All versions | None |
github.com/juju/juju Go | All versions | 2.9.50 |
github.com/juju/juju Go | All versions | 2.9.50 |
github.com/juju/juju Go | From 3.0.0 | 3.1.9 |
github.com/juju/juju Go | From 3.0.0 | 3.1.9 |
6 more packages
github.com/juju/juju Go | From 3.2.0 | 3.3.6 |
github.com/juju/juju Go | From 3.2.0 | 3.3.6 |
github.com/juju/juju Go | From 3.4.0 | 3.4.5 |
github.com/juju/juju Go | From 3.4.0 | 3.4.5 |
github.com/juju/juju Go | From 3.5.0 | 3.5.3 |
github.com/juju/juju Go | From 3.5.0 | 3.5.3 |
Products include Canonical Juju.
How do I fix CVE-2024-6984?
Upgrade github.com/juju/juju to a fixed version for your release line: 2.9.50, 3.1.9, 3.3.6 or 3.4.5.
Is CVE-2024-6984 being exploited?
There is no known exploitation of CVE-2024-6984 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ltd. Juju
- CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions
- CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
- CVE-2025-0928 Arbitrary executable upload via authenticated endpoint
Sources
Also known as GHSA-6vjm-54vp-mxhx, GO-2024-3010, GO-2024-3040.