CVE-2024-6984 — Vulnerability in github.com/juju/juju — CVE Details

HIGH

Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm

Published August 5, 2024Updated July 8, 2026Source: osv

Summary

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.

Advisory Timeline

First published August 5, 2024 (798 days ago).
Last revised July 8, 2026 — 702 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/juju/juju to 3.3.6 or later

go get github.com/juju/juju@v3.3.6

Update github.com/juju/juju to 2.9.50 or later

go get github.com/juju/juju@v2.9.50

Update github.com/juju/juju to 3.5.3 or later

go get github.com/juju/juju@v3.5.3

Update github.com/juju/juju to 3.4.5 or later

go get github.com/juju/juju@v3.4.5

Update github.com/juju/juju to 3.1.9 or later

go get github.com/juju/juju@v3.1.9

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (5)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
github.com/juju/juju	go	All versions	3.3.6
github.com/juju/juju	go	All versions	2.9.50
github.com/juju/juju	go	All versions	3.5.3
github.com/juju/juju	go	All versions	3.4.5
github.com/juju/juju	go	All versions	3.1.9

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-209
View on MITRE
CWE-269
Improper Privilege ManagementMITRE
CWE-284
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-6984?: Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2024-6984?: CVE-2024-6984 affects github.com/juju/juju. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-6984 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-6vjm-54vp-mxhx

GO-2024-3010

GO-2024-3040

Related CVEs

CVE-2026-4370
CRITICAL
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster
CVE-2017-9232
CRITICAL
Juju uses a UNIX domain socket without setting appropriate permissions
CVE-2026-5412
CRITICAL
Juju: CloudSpec method leaking cloud credentials
CVE-2025-53513
HIGH
Juju zip slip vulnerability via authenticated endpoint
CVE-2026-107809
HIGH
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
CVE-2026-32693
HIGH
Juju has unauthorized access to out-of-scope Kubernetes secrets
CVE-2025-0928
HIGH
Juju allows arbitrary executable uploads via authenticated endpoint without authorization
CVE-2026-107813
HIGH
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies