CVE-2026-32693

In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:36

Type	Values Removed	Values Added
Summary		(es) En Juju desde la versión 3.0.0 hasta la 3.6.18, la autorización de la herramienta 'secret-set' no se realiza correctamente, lo que permite a un beneficiario actualizar el contenido del secreto, y puede llevar a la lectura o actualización de otros secretos. Cuando la herramienta 'secret-set' registra un error en un intento de explotación, el secreto aún se actualiza contrariamente a lo esperado, y el nuevo valor es visible tanto para el propietario como para el beneficiario.

19 Mar 2026, 15:17

Type	Values Removed	Values Added
References	~~() https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc -~~	() https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc - Exploit, Vendor Advisory
First Time		Canonical Canonical juju
CPE		cpe:2.3:a:canonical:juju::::::::

18 Mar 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-18 13:16

Updated : 2026-06-17 10:36

NVD link : CVE-2026-32693

Mitre link : CVE-2026-32693

CVE.ORG link : CVE-2026-32693

JSON object : View

Products Affected

canonical

juju

CWE

CWE-284

Improper Access Control

CWE-778

Insufficient Logging

CWE-863

Incorrect Authorization

{"id": "CVE-2026-32693", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32693", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-18T13:16:08.879696Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/juju/juju", "vendor": "Canonical", "product": "Juju", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.6.19", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "juju", "collectionURL": "https://github.com/juju/", "defaultStatus": "unaffected"}]}], "published": "2026-03-18T13:16:18.860", "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc", "tags": ["Exploit", "Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-778"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In Juju from version 3.0.0 through 3.6.18, the authorization of the \"secret-set\" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the \"secret-set\" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee."}, {"lang": "es", "value": "En Juju desde la versi\u00f3n 3.0.0 hasta la 3.6.18, la autorizaci\u00f3n de la herramienta 'secret-set' no se realiza correctamente, lo que permite a un beneficiario actualizar el contenido del secreto, y puede llevar a la lectura o actualizaci\u00f3n de otros secretos. Cuando la herramienta 'secret-set' registra un error en un intento de explotaci\u00f3n, el secreto a\u00fan se actualiza contrariamente a lo esperado, y el nuevo valor es visible tanto para el propietario como para el beneficiario."}], "lastModified": "2026-06-17T10:36:13.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BAFE599-DF11-429B-9A8C-970BDB3065C8", "versionEndExcluding": "3.6.19", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}