PT-2026-26056 · Canonical · Juju

Harry Pidcock · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-32692

NVD

CVSS v3.1

7.6

High

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-32692

Affected Products

Juju

References · 2

• https://github.com/juju/juju/security/advisories/GHSA-89x7-5m5m-mcmm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32692 · Security Note