ops
Pure Python framework for writing Juju charms.
View on Github
Activity
- Latest release
- 2w ago
- Total releases
- 83
- Cadence
- ~27 days
- Last 12 months
- 16
Reach
- Stars
- 265
Details
- License
- Apache-2.0
- First release
- Dec 18, 2010
| Version | Released | |
|---|---|---|
2.23.5
patch
| ||
3.8.2
patch
| ||
2.23.4
patch
| ||
3.8.1
patch
| ||
3.8.0
minor
| ||
3.7.1
patch
| ||
3.7.0
minor
| ||
3.6.0
minor
| ||
2.23.2
patch
| ||
3.5.2
patch
| ||
3.5.1
patch
| ||
3.5.0
minor
| ||
3.4.0
minor
| ||
3.4.0b3
pre
| ||
3.4.0b1
pre
| ||
3.3.1
patch
| ||
3.3.0
minor
| ||
3.2.0
minor
| ||
2.23.1
patch
| ||
3.1.0
minor
| ||
3.0.0
major
| ||
2.23.0
minor
| ||
2.23.0.dev0
pre
| ||
2.22.0
minor
| ||
2.21.1
patch
| ||
2.21.0
minor
| ||
2.20.0
minor
| ||
2.19.4
patch
| ||
2.19.0
minor
| ||
2.18.1
patch
| ||
2.18.0
minor
| ||
2.17.1
patch
| ||
2.17.0
minor
| ||
2.16.1
patch
| ||
2.16.0
minor
| ||
2.15.0
minor
| ||
2.14.1
patch
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.14.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.13.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.12.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.11.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.10.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.9.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.8.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.7.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.6.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.1
patch
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.1
patch
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.0
minor
1 CVE
CVE-2024-41129
PYSEC-2026-1753
GHSA-hcmv-jmqh-fjgm
Jul 07, 2026
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
High
Network
Low
High
None
SummaryThe issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing There are two points that may log this command, in different files: First, if there is an error during a secret handling, there will be a Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening. Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only). Passing secrets straight via CLI is not advised. Here are some ways out:
Severity RationaleThis is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an DetailsFrom CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364 PoC
ImpactJuju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment. Affected versions
2.0.0
2.1.0
2.1.1
2.10.0
2.11.0
2.12.0
2.13.0
2.14.0
2.14.1
2.2.0
2.3.0
2.4.0
+ 7 more Show less
2.4.1
2.5.0
2.5.1
2.6.0
2.7.0
2.8.0
2.9.0
Fixed in
2.15.0
References
Updated Jul 07, 2026 · Source: OSV.dev |