CVE-2026-32693— Unauthorized access to Kubernetes secrets in Juju
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-32693
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthorized access to Kubernetes secrets in Juju
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juju 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juju是Canonical Juju开源的一个开源应用程序编排引擎。 Juju 3.0.0至3.6.18版本存在安全漏洞，该漏洞源于secret-set工具授权不正确，可能导致被授权者更新密钥内容并读取或更新其他密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-32693
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32693
请登录查看更多情报信息。
Same Patch Batch · Canonical · 2026-03-18 · 4 CVEs total
| CVE-2026-32692 | 7.6 HIGH | Unauthorized update of out-of-scope Vault secrets |
| CVE-2026-32694 | 6.6 MEDIUM | Insecure Direct Object Reference attack via predictable secret ID in Juju |
| CVE-2026-32691 | 5.3 MEDIUM | Timing ownership claim attack on new external back-end secrets |
IV. Related Vulnerabilities
Same product: Juju
- CVE-2026-5412
Juju CloudSpec API could leak senstive information - CVE-2026-5774
Juju API Server Denial of Service and Authentication Replay - CVE-2025-68153
Juju: Resource poisoning - CVE-2025-68152
Juju: Read All Controller Logs From Compromised Workload - CVE-2026-4370
Improper TLS Client/Server authentication and certificate ve
Same vendor: Canonical
- CVE-2026-6970
authd Denial of Service and Local Privilege Escalation - CVE-2026-6369
Exposed Session Token in canonical-livepatch client snap - CVE-2026-5412
Juju CloudSpec API could leak senstive information - CVE-2026-5774
Juju API Server Denial of Service and Authentication Replay - CVE-2025-14551
Senstive information disclosure was affecting subiquity
Same weakness: CWE-863
- CVE-2026-42571
Privilege Escalation Attack affecting Pelican Web UI - CVE-2025-15633
HCL BigFix WebUI is affected by an improper authorization vu - CVE-2026-42296
Argo Workflows has incomplete fix for CVE-2026-31892: hostNe - CVE-2025-66170
Apache CloudStack: Any user can list backups that they shoul - CVE-2026-41903
FreeScout IDOR Vulnerability: PERM_EDIT_USERS allows modifyi
V. Comments for CVE-2026-32693
No comments yet