https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:27:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-247035 EUVD-2026-247035 https://cve.radiocsirt.org/vuln/euvd-2026-247035 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53512 <p>The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.</p> <p>The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-53512 https://cve.radiocsirt.org/vuln/ghsa-r64v-82fh-xc63 <p><strong>Affected:</strong> Go: github.com/juju/juju</p> <p>### Impact Any user with a Juju account on a controller can read debug log messages from the `/log` endpoint. No specific permissions are required - it&#39;s just sufficient for the user to exist in the controller user database. The log messages may contain sensitive information.</p> <p>### Details</p> <p>The `/log` endpoint is accessible at the following endpoints: - `wss://&lt;controller-ip&gt;/log` - `wss://&lt;controller-ip&gt;/model/&lt;model-uuid&gt;/log`</p> <p>In order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.</p> <p>To reproduce:</p> <p>``` juju bootstrap juju add-user testuser juju change-user-password testuser ``` Run the [wscat](https://github.com/websockets/wscat) command below to connect to `wss://&lt;controller-ip&gt;:17070/api`. Update the JSON payload to include the username and password that were created above.</p> <p>``` wscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api { &#34;type&#34;: &#34;Admin&#34;, &#34;request&#34;: &#34;Login&#34;, &#34;version&#34;: 3, &#34;params&#34;: { &#34;client- version&#34;: &#34;3.6.1.0&#34;, &#34;auth-tag&#34;: &#34;user-testuser&#34;, &#34;credentials&#34;: &#34; password&#34; } } ```</p> <p>Observe that the connection fails due to a lack of permissions.</p> <p>Run the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.</p> <p>``` wscat --auth user-testuser:password -H &#34;X-Juju-ClientVersion: 3.6.4&#34; --…</p> <p><strong>Affected:</strong> Go: github.com/juju/juju</p> <p>### Impact Any user with a Juju account on a controller can read debug log messages from the `/log` endpoint. No specific permissions are required - it&#39;s just sufficient for the user to exist in the controller user database. The log messages may contain sensitive information.</p> <p>### Details</p> <p>The `/log` endpoint is accessible at the following endpoints: - `wss://&lt;controller-ip&gt;/log` - `wss://&lt;controller-ip&gt;/model/&lt;model-uuid&gt;/log`</p> <p>In order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.</p> <p>To reproduce:</p> <p>``` juju bootstrap juju add-user testuser juju change-user-password testuser ``` Run the [wscat](https://github.com/websockets/wscat) command below to connect to `wss://&lt;controller-ip&gt;:17070/api`. Update the JSON payload to include the username and password that were created above.</p> <p>``` wscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api { &#34;type&#34;: &#34;Admin&#34;, &#34;request&#34;: &#34;Login&#34;, &#34;version&#34;: 3, &#34;params&#34;: { &#34;client- version&#34;: &#34;3.6.1.0&#34;, &#34;auth-tag&#34;: &#34;user-testuser&#34;, &#34;credentials&#34;: &#34; password&#34; } } ```</p> <p>Observe that the connection fails due to a lack of permissions.</p> <p>Run the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.</p> <p>``` wscat --auth user-testuser:password -H &#34;X-Juju-ClientVersion: 3.6.4&#34; --…</p> https://cve.radiocsirt.org/vuln/ghsa-r64v-82fh-xc63 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1 <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15405-1