Juju EUVD-2026-12817

Requires Juju versions 3.1.6 through 3.6.18 with Vault secrets back-end enabled. Attacker must be an authenticated unit agent within the Juju deployment. No victim interaction needed. Remote exploitation possible within the cluster.

The real-world risk is elevated based on multiple factors. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) indicates this is a network-exploitable vulnerability with low attack complexity requiring only low privileges and no user interaction, making it relatively easy to exploit once an attacker has authenticated unit agent access. The high integrity impact (I:H) is particularly concerning as secret poisoning could enable attackers to inject malicious credentials or configuration data that would be trusted by other services. However, the requirement for authenticated access (PR:L) and the need for sufficient information about existing secrets provides some barrier to entry. Without EPSS data or KEV listing, widespread active exploitation is not indicated, but the Canonical origin and GitHub security advisory suggest this is a legitimate vendor-acknowledged issue affecting production deployments. Organizations using Juju with Vault back-ends should prioritize this based on the low complexity and high integrity impact, especially in multi-tenant or untrusted deployment scenarios where unit agents may be compromised.

An attacker who has compromised a single unit agent within a Juju deployment (perhaps through a separate application vulnerability or stolen credentials) can leverage this authorization bypass to modify secret revisions managed by the Vault back-end beyond their intended scope. With knowledge of secret paths and revision identifiers, the attacker could poison credentials used by other applications in the deployment, such as injecting malicious database passwords or API keys that would then be consumed by legitimate services. The network-based attack vector with low complexity means that once an attacker gains authenticated unit agent access, exploitation can be automated without complex attack chains or user interaction, potentially enabling lateral movement and privilege escalation across the entire Juju-managed infrastructure.