CVE-2026-32693
HIGH
canonical
NVD
CVSS Score
8.8
Severity
HIGH
Published
Mar 18, 2026
Vendor
canonical
Description
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.