CVE-2026-32693
High
Description
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCanonical Juju
PublishedMar 18, 2026
First seenMar 18, 2026
How to fix
Update
- canonical juju3.6.19 or later
- github.com/juju/juju0.0.0-20260319091847-d06919eb03ec or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canonical juju | 3.0.0 ≤ v < 3.6.19 | 3.6.19 |
| github.com/juju/jujuGo | 0.0.0-20221021155847-35c560704ee2 ≤ v < 0.0.0-20260319091847-d06919eb03ec | 0.0.0-20260319091847-d06919eb03ec |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.