CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
Attackers can bypass authorization checks to read or modify Kubernetes secrets in Juju, compromising sensitive data integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32693?
CVE-2026-32693 is a high-severity missing authorization vulnerability in Canonical Juju, published on 18 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.
Which versions are affected by CVE-2026-32693?
3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/juju Go | From 0.0.0-20221021155847-35c560704ee2 | 0.0.0-20260319091847-d06919eb03ec |
github.com/juju/juju Go | From 0.0.0-20221021155847-35c560704ee2 | 0.0.0-20260319091847-d06919eb03ec |
github.com/juju/juju Go | From 0.0.0-20221021155847-35c560704ee2 | 0.0.0-20260319091847-d06919eb03ec |
Products include Canonical Juju.
How do I fix CVE-2026-32693?
Upgrade github.com/juju/juju to 0.0.0-20260319091847-d06919eb03ec or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-32693 being exploited?
There is no known exploitation of CVE-2026-32693 in the wild and no public exploit code.
Other vulnerabilities in Canonical Juju
- CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions
- CVE-2025-0928 Arbitrary executable upload via authenticated endpoint
- CVE-2025-53513 Zip slip vulnerability in Juju
Sources
Also known as GHSA-439w-v2p7-pggc, GO-2026-4777.