Juju CVE-2026-32693

Juju versions 3.0.0–3.6.18. Attacker requires low-privilege authenticated access to Juju (PR:L). Must be a grantee with secret access permissions. Exploit executed via 'secret-set' tool command to update secret content, bypassing authorization checks. No victim interaction needed.

This vulnerability presents significant real-world risk with a CVSS 3.1 score of 8.8 (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires only low privileges (PR:L) with no user interaction (UI:N), making it highly exploitable by authenticated malicious insiders or compromised accounts. The impact encompasses high confidentiality, integrity, and availability (C:H/I:H/A:H). While no EPSS score or KEV status is provided in the intelligence data, the low complexity and network accessibility combined with authentication bypass tags suggest this could be readily exploited in environments where Juju is deployed. The fact that exploitation succeeds even when errors are logged creates a dangerous false sense of security, as administrators may believe failed attempts were blocked when secrets are actually being compromised. Organizations using Juju for cloud orchestration should prioritize remediation given the potential for lateral movement through compromised secrets.

An authenticated attacker with low-level grantee access to a Juju-managed cloud environment could exploit this vulnerability by using the 'secret-set' tool to modify secrets beyond their authorized scope. The attacker could potentially read sensitive credentials belonging to other applications or services, modify database passwords or API keys used by critical services, or escalate privileges by updating authentication secrets. Even if the system logs an error indicating unauthorized access, the malicious changes persist, allowing the attacker to leverage compromised credentials for lateral movement across the cloud infrastructure without triggering proper security alerts.