CVE-2026-32693:

Authorization bypass in Juju's "secret-set" tool allows unauthorized secret updates and access.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Mar 18, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Authorization bypass in Juju's "secret-set" tool allows unauthorized secret updates and access.

Overview

The vulnerability in Juju, identified as CVE-2026-32693, is a critical security flaw that impacts the confidentiality and integrity of secret management. With a CVSS v3.1 base score of 8.8 (High), this issue poses significant risks to affected systems. The vulnerability stems from improper authorization checks in the "secret-set" tool, allowing potential attackers with low privileges to manipulate and access sensitive information. This flaw affects Juju versions from 3.0.0 to 3.6.18, exposing a wide range of installations to potential exploitation. The vulnerability's impact is amplified by the fact that even failed exploitation attempts can result in unintended secret updates, further compromising the security of the affected systems.

Remediation

To address this vulnerability, it is strongly recommended that users upgrade to Juju version 3.6.19 or later, which contains the necessary security fixes. Organizations using affected versions should prioritize this update to mitigate the risk of unauthorized secret access and manipulation. In addition to upgrading, it is advisable to conduct a thorough review of all secrets managed by affected Juju installations to identify any potential unauthorized changes or access. Implementing additional access controls and monitoring mechanisms around secret management processes can provide an extra layer of security. Users should also stay informed about any further security advisories or patches released by Canonical regarding this issue.