PT-2026-26057 · Canonical · Juju

Dima Tisnek · Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-32693

Mitre

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-778

CWE-284

Related Identifiers

CVE-2026-32693

Affected Products

Juju

References · 2

• https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32693 · Security Note