CVE-2026-32693: 
NixOS vulnerability analysis and mitigation

CVE-2026-32693 is an authorization bypass vulnerability in Canonical's Juju orchestration framework affecting versions 3.0.0 through 3.6.18. The flaw exists in the secret-set hook tool, which fails to correctly enforce authorization, allowing a grantee application to modify secret content it should only be able to read, and potentially read or modify other secrets in the same Kubernetes secret backend. It was published on March 18, 2026, with a patch released in version 3.6.19. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Juju Advisory).

The root cause is an incorrect authorization check (CWE-863) combined with improper access control (CWE-284) in Juju's secret-set hook tool, stemming from an overly broad Kubernetes access policy. When a grantee application calls secret-set on a secret it was granted read access to, the controller fails to properly validate that the caller is the secret owner before applying the update. Critically, even when the operation logs a "permission denied" error (CWE-778: Insufficient Logging), the secret value is still updated in the Kubernetes backend and the new value becomes visible to both the owner and the grantee — without creating a new secret revision. This means the error log gives a false impression that the unauthorized write was rejected. A public proof-of-concept command sequence demonstrating the full exploit on Canonical K8s with Juju 3.6.8 is included in the official advisory (Juju Advisory).

Any authenticated application with grantee-level access to a Juju secret can silently overwrite that secret's value, affecting the owning application and any other grantees. Beyond modifying the granted secret, the broad Kubernetes access policy means an attacker may also read or modify other secrets stored in the same Kubernetes secret backend — including secrets belonging to unrelated applications in the same model. This results in high confidentiality, integrity, and availability impacts: sensitive credentials or configuration data can be exfiltrated or poisoned, potentially enabling lateral movement across applications sharing the same Juju controller (Juju Advisory, GitHub Advisory).

A proof-of-concept exploit consisting of a concrete sequence of juju exec commands is publicly available in the official GitHub Security Advisory, demonstrated on a real Juju 3.6.8 deployment with Canonical K8s (Juju Advisory). Exploitation requires only low privileges — specifically, an application with a granted relation to a target secret. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.051–0.081%, placing it in the 24th percentile for exploitation likelihood (GitHub Advisory). Qualys has added detection for this vulnerability (detection ID 761875) (Feedly).

1. Reconnaissance: Identify a target Juju deployment running versions 3.0.0–3.6.18 on a Kubernetes backend. Confirm that your application (the attacker-controlled unit) has been granted access to a secret via a relation.
2. Identify the secret URI: Use juju exec --unit <owner-unit> "secret-add key=value" to create a secret (if you own one), or obtain the secret URI (e.g., secret://.../<secret-id>) through legitimate grantee access or by knowing the Kubernetes secret name.
3. Attempt unauthorized secret update: From the grantee unit, run:

   juju exec --unit <grantee-unit> "secret-set <secret-id> key=malicious-value"

   The command will log updating secrets: permission denied but return an OK exit status.
4. Verify secret was updated: From the owner unit, run juju exec --unit <owner-unit> "secret-get <secret-id>" — the output will reflect the attacker-controlled value, confirming the unauthorized write succeeded.
5. Enumerate and attack other secrets: Leveraging the broad Kubernetes RBAC policy, attempt to read or patch other Kubernetes secrets in the same backend by referencing known secret identifiers (e.g., Kubernetes secret names), potentially accessing credentials belonging to other applications in the same model (Juju Advisory).

• Logs: Juju controller logs showing updating secrets: permission denied errors originating from a grantee unit (not the secret owner) — especially if the secret value was subsequently changed; discrepancy between logged errors and actual secret state in Kubernetes.
• Juju Audit: Secret revisions not incrementing despite value changes; juju show-secret output reflecting values inconsistent with owner-initiated updates.
• Kubernetes: Unexpected PATCH or UPDATE operations on Kubernetes Secret objects in the Juju namespace originating from application service accounts that are grantees rather than owners; audit logs in the Kubernetes API server showing secret modifications by non-owner workload identities.
• Application Behavior: Applications receiving unexpected or altered secret values (e.g., credentials that were not rotated by the owner); authentication failures in downstream services caused by poisoned secret values (Juju Advisory).

Canonical has released Juju version 3.6.19 which corrects the authorization logic in the secret-set hook tool. All users running Juju 3.0.0 through 3.6.18 on Kubernetes backends should upgrade immediately. No configuration-based workaround is available. Post-upgrade, administrators should audit all secret access grants to identify unauthorized modifications, review Kubernetes API server audit logs for unexpected secret PATCH operations, and rotate any secrets that were accessible to grantee applications during the vulnerable period (Juju Advisory, GitHub Advisory).

The vulnerability received coverage from The Hacker Wire, which published an article titled "Juju secret-set auth bypass leads to secret disclosure" shortly after the advisory was released (The Hacker Wire). A Reddit thread in r/pwnhub discussed the authorization bypass and its implications for Kubernetes secret security. The openSUSE security announce mailing list also referenced the issue in the context of govulncheck/vulndb advisories. Community reaction has been moderate, with security researchers noting the deceptive nature of the false "permission denied" error that masks a successful unauthorized write.