CVE-2026-32692: 
NixOS vulnerability analysis and mitigation

CVE-2026-32692 is an authorization bypass vulnerability in the Vault secrets back-end implementation of Canonical's Juju orchestration software, titled "Unauthorized update of out-of-scope Vault secrets." It affects Juju versions 3.1.6 through 3.6.18 and was disclosed on March 18, 2026, with a patch released in version 3.6.19. The vulnerability carries a CVSS v3.1 base score of 7.6 (High) per the GitHub Security Advisory (GitHub Advisory, Juju Advisory).

The root cause is classified as CWE-285 (Improper Authorization): the Vault secrets back-end implementation in Juju fails to correctly enforce authorization checks when a unit agent attempts to update secret revisions. An authenticated unit agent can issue update requests targeting secret revisions that belong to other units or applications within the same Vault back-end scope, bypassing the intended access boundary. Exploitation requires network access and low-level authentication (a valid unit agent credential), but no user interaction or elevated privileges beyond that. No public proof-of-concept code has been identified (Juju Advisory, GitHub Advisory).

A successful exploit allows an authenticated unit agent to overwrite or "poison" any secret revision accessible within the Vault back-end used by the unit's model, resulting in a high integrity impact on sensitive secrets managed through Juju's Vault integration. Confidentiality and availability impacts are rated low — an attacker may incidentally read secret data during the update process and could disrupt services relying on those secrets. Organizations using Juju with Vault as their secrets back-end face the risk of credential or configuration data being silently corrupted, potentially enabling further lateral movement or service disruption (Juju Advisory, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.04% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Obtain unit agent credentials: Gain access to a valid Juju unit agent credential (e.g., by compromising a deployed charm or unit within the target Juju model).
2. Identify target Vault back-end scope: Enumerate the Vault secrets back-end associated with the unit's model to identify accessible secret revisions and their identifiers.
3. Craft unauthorized update request: Using the authenticated unit agent session, send an API request to update a secret revision that belongs to a different unit or application within the same Vault back-end scope — bypassing the authorization check.
4. Poison the secret revision: Supply a malicious or corrupted secret value in the update payload, replacing the legitimate secret data for the targeted revision.
5. Achieve objective: The poisoned secret is now served to any unit or application that reads that revision, potentially enabling credential theft, service disruption, or further lateral movement within the Juju-managed environment (Juju Advisory).

• Logs: Juju controller logs showing unit agent API calls to update secret revisions for secrets not owned by the requesting unit; unexpected SecretRevisionUpdated or equivalent audit log entries from unit agents acting outside their normal scope.
• Network: Unusual or high-frequency API requests from a unit agent to the Juju controller's secrets management endpoints, particularly targeting secret IDs associated with other applications or units.
• Application Behavior: Services or charms unexpectedly failing to authenticate or connect to downstream systems due to corrupted credentials stored in Vault-backed secrets; sudden changes in secret revision content without corresponding operator activity.

Canonical has released Juju version 3.6.19 as the patched release, which corrects the authorization logic in the Vault secrets back-end. All users running Juju 3.1.6 through 3.6.18 with Vault as their secrets back-end should upgrade to 3.6.19 or later as the primary remediation. As an interim measure, organizations should implement additional monitoring of secret revision modification events and restrict unit agent network access where feasible (Juju Advisory, GitHub Advisory).

The vulnerability was credited to researcher hpidcock and published by nikosgalanis on the Juju GitHub repository. An openSUSE security announcement and Linux security advisory were subsequently issued, indicating downstream distribution awareness. Social media activity was limited, with brief mentions on Mastodon and Bluesky, reflecting modest community interest consistent with the lack of active exploitation (Juju Advisory).