cve.bz

CVE-2026-32692

6.5 mediumEPSS 0.2%

Medium (6.5) in canonical juju. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/juju/juju 0.0.0-20260319091847-d06919eb03ec.

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE
CWE-285
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-89x7-5m5m-mcmmGogithub.com/juju/juju>=0.0.0-20230919230135-f6a66aa91eec <0.0.0-20260319091847-d06919eb03ec0.0.0-20260319091847-d06919eb03ec
GO-2026-4781Gogithub.com/juju/juju>=0.0.0-20230919230135-f6a66aa91eec <0.0.0-20260319091847-d06919eb03ec0.0.0-20260319091847-d06919eb03ec

References

Check your stackJSON