Resource poisoning allows an authenticated user, machine or controller to modify the resources of any application located within a Juju controller. This results in unauthorized changes to application configuration or deployment which can lead to loss of control over the application, potential service interruption, and misuse of resources. The weakness is an access control flaw described by CWE‑863.

Juju installations running versions 2.9.0 through 2.9.55 and 3.6.0 through 3.6.18 are vulnerable. All users or machines authenticated against any Juju controller can exploit the vulnerability, affecting every application managed by that controller.

The CVSS score of 7.1 indicates a high severity. The exploit probability is not documented, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to authenticate to the controller to manipulate resources; thus the vector is authenticated user access. Once accessed, the attacker can alter any application’s resource settings, potentially causing service disruption or other impacts. The risk is significant for environments that rely on strict access controls.