CVE-2026-32693 is an authorization bypass vulnerability affecting Canonical's Juju software, specifically versions 3.0.0 through 3.6.18. Juju is a popular open-source application modeling tool used for deploying, configuring, and managing cloud infrastructure and services. The vulnerability resides in the "secret-set" tool, which is responsible for managing secret data within Juju. The core issue is an incorrect authorization check (CWE-863) that allows a grantee—an entity with delegated but limited permissions—to update secret contents they should not have access to. This flaw also relates to improper access control (CWE-284) and potentially improper handling of sensitive data (CWE-778). When an exploitation attempt triggers an error, the system logs the error but still proceeds to update the secret with the new value. This behavior contradicts expected security controls and results in the new secret value being visible to both the secret owner and the grantee, thereby compromising confidentiality and integrity. The vulnerability can be exploited remotely over the network (AV:N) with low attack complexity (AC:L) and requires only privileges of a grantee (PR:L), without any user interaction (UI:N). The scope is unchanged (S:U), but the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), leading to a CVSS v3.1 base score of 8.8. Although no known exploits are currently reported in the wild, the ease of exploitation and the critical nature of secret management make this a significant risk. Juju is widely used in cloud and infrastructure automation environments, making this vulnerability relevant to organizations relying on Juju for secret orchestration and management.

The vulnerability allows unauthorized users with limited privileges to update and potentially read secrets they should not have access to. This can lead to unauthorized disclosure of sensitive information such as credentials, API keys, or configuration secrets, undermining confidentiality. Integrity is compromised because unauthorized users can alter secret values, potentially disrupting system operations or enabling further attacks such as privilege escalation or lateral movement. Availability may also be affected if critical secrets are corrupted or replaced, causing service disruptions. Organizations using Juju for managing secrets in cloud or hybrid environments face risks of data breaches, compliance violations, and operational outages. The impact is especially severe in environments where secrets control access to critical infrastructure or sensitive data. Attackers exploiting this flaw could gain footholds or escalate privileges within targeted environments, increasing the overall threat landscape.

1. Upgrade Juju to a version later than 3.6.18 where this vulnerability is patched, as soon as a fix is available from Canonical. 2. Until a patch is applied, restrict network access to the Juju secret management interfaces to trusted administrators only, using network segmentation and firewall rules. 3. Review and tighten grantee permissions to the minimum necessary, avoiding unnecessary delegation of secret update rights. 4. Implement monitoring and alerting on secret update operations to detect anomalous or unauthorized changes promptly. 5. Conduct regular audits of secret values and access logs to identify potential exploitation attempts. 6. Use external secret management solutions with robust access controls as a compensating control if immediate patching is not feasible. 7. Educate administrators about the risk of this vulnerability and the importance of controlling secret access and updates carefully. 8. Follow Canonical’s security advisories for updates and recommended best practices related to Juju secret management.