Read the docs
TI-2026-25184 Aliases CVE-2026-32692GHSA-89x7-5m5m-mcmm

Unauthorized update of out-of-scope Vault secrets

Priority LOW 32CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed Juju (Canonical): 3.6.19github.com/juju/juju (Go): 0.0.0-20260319091847-d06919eb03ec

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju3.1.6 to before 3.6.193.6.19Patch availableCNA
—github.com/juju/juju (Go)0.0.0-20230919230135-f6a66aa91eec to before 0.0.0-20260319091847-d06919eb03ec0.0.0-20260319091847-d06919eb03ecPatch availableGHSA-89x7-5m5m-mcmm
  • Juju VendorCanonical Affected 3.1.6 to before 3.6.19 Fixed in 3.6.19 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected 0.0.0-20230919230135-f6a66aa91eec to before 0.0.0-20260319091847-d06919eb03ec Fixed in 0.0.0-20260319091847-d06919eb03ec Patch available GHSA-89x7-5m5m-mcmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*3.1.6 to before 3.6.19VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions 3.1.6 to before 3.6.19 Vulnerable ·Canonical

Remediation

  • Fix · CNA Juju (Canonical) Fixed in 3.6.19
  • Fix · GHSA-89x7-5m5m-mcmm github.com/juju/juju (Go) Fixed in 0.0.0-20260319091847-d06919eb03ec Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical Juju 3.6.19

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in JujuPriority MEDIUM 64
    • TI-2026-25185 Unauthorized access to Kubernetes secrets in JujuPriority MEDIUM 40
    • TI-2026-25183 Timing ownership claim attack on new external back-end secretsPriority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32692
  2. 2026-10-03 Alias added: GHSA-89x7-5m5m-mcmm

References

Advisory 2

Other 2

  • TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences