CVE-2026-32692 Unauthorized update of out-of-scope Vault secrets
An authenticated unit agent can bypass authorization to modify secret revisions in the Vault back-end, potentially poisoning sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32692?
CVE-2026-32692 is a high-severity missing authorization vulnerability in Canonical Juju, published on 18 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.
Weakness: CWE-285
Which versions are affected by CVE-2026-32692?
3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/juju Go | From 0.0.0-20230919230135-f6a66aa91eec | 0.0.0-20260319091847-d06919eb03ec |
github.com/juju/juju Go | From 0.0.0-20230919230135-f6a66aa91eec | 0.0.0-20260319091847-d06919eb03ec |
github.com/juju/juju Go | From 0.0.0-20230919230135-f6a66aa91eec | 0.0.0-20260319091847-d06919eb03ec |
Products include Canonical Juju.
How do I fix CVE-2026-32692?
Upgrade github.com/juju/juju to 0.0.0-20260319091847-d06919eb03ec or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-32692 being exploited?
There is no known exploitation of CVE-2026-32692 in the wild and no public exploit code.
Other vulnerabilities in Canonical Juju
- CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions
- CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
- CVE-2025-0928 Arbitrary executable upload via authenticated endpoint
Sources
Also known as GHSA-89x7-5m5m-mcmm, GO-2026-4781.