CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2026-32693
High (8.8) in canonical juju. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/juju/juju 0.0.0-20260319091847-d06919eb03ec.
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-284, CWE-778, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:juju
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-439w-v2p7-pggc | Go | github.com/juju/juju | >=0.0.0-20221021155847-35c560704ee2 <0.0.0-20260319091847-d06919eb03ec | 0.0.0-20260319091847-d06919eb03ec |
| GO-2026-4777 | Go | github.com/juju/juju | >=0.0.0-20221021155847-35c560704ee2 <0.0.0-20260319091847-d06919eb03ec | 0.0.0-20260319091847-d06919eb03ec |