Authorization Flaw in Juju Affects Multiple Versions

CVE-2026-32693

What is CVE-2026-32693?

The Juju platform, spanning versions 3.0.0 to 3.6.18, contains an authorization flaw in its 'secret-set' tool. This vulnerability arises because the tool fails to correctly authorize operations, allowing an unauthorized grantee to potentially modify sensitive secret data. This could lead to the unintended exposure of secrets, as the flawed system logs errors while allowing updates. Thus, both the secret owner and grantee can view the new secret content, heightening the risks associated with the management of sensitive information.

References