Read the docs
TI-2026-25185 Aliases CVE-2026-32693GHSA-439w-v2p7-pggc

Unauthorized access to Kubernetes secrets in Juju

Priority MEDIUM 40CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Juju (Canonical): 3.6.19github.com/juju/juju (Go): 0.0.0-20260319091847-d06919eb03ec

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju3.0.0 to before 3.6.193.6.19Patch availableCNA
—github.com/juju/juju (Go)0.0.0-20221021155847-35c560704ee2 to before 0.0.0-20260319091847-d06919eb03ec0.0.0-20260319091847-d06919eb03ecPatch availableGHSA-439w-v2p7-pggc
  • Juju VendorCanonical Affected 3.0.0 to before 3.6.19 Fixed in 3.6.19 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected 0.0.0-20221021155847-35c560704ee2 to before 0.0.0-20260319091847-d06919eb03ec Fixed in 0.0.0-20260319091847-d06919eb03ec Patch available GHSA-439w-v2p7-pggc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*3.0.0 to before 3.6.19VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.6.19 Vulnerable ·Canonical

Remediation

  • Fix · CNA Juju (Canonical) Fixed in 3.6.19
  • Fix · GHSA-439w-v2p7-pggc github.com/juju/juju (Go) Fixed in 0.0.0-20260319091847-d06919eb03ec Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical Juju 3.6.19

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in JujuPriority MEDIUM 64
    • TI-2026-25184 Unauthorized update of out-of-scope Vault secretsPriority LOW 32
    • TI-2026-25183 Timing ownership claim attack on new external back-end secretsPriority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32693
  2. 2026-10-03 Alias added: GHSA-439w-v2p7-pggc

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2026-25186 Insecure Direct Object Reference attack via predictable secret ID in Juju CVSS 3.1MEDIUM 6.6
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences