Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-32693 is a high-severity Improper Access Control (CWE-284) vulnerability in Canonical Juju. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32693 is an authorization vulnerability affecting Juju versions 3.0.0 through 3.6.18. The issue lies in the improper authorization checks for the "secret-set" tool, enabling a grantee to update secret content and potentially read or update other secrets. Additionally, even when the tool logs an error during an exploitation attempt, the secret is still updated unexpectedly, making the new value visible to both the owner and the grantee. The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWEs 284 (Improper Access Control), 778 (Insufficient Logging), and 863 (Incorrect Authorization).
An attacker with low privileges, specifically a grantee of a secret, can exploit this over the network with low complexity and no user interaction required. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, including unauthorized updates to secret content, reading of other secrets, and persistent changes that remain visible despite error logging.
Mitigation details are available in the GitHub Security Advisory at https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12819
Vulnerability Data
In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs…
more
an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 24 hardening rules · 5 OS baselines
V10.3.5
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.
AU-12 requires the system to generate audit records for defined events, structurally eliminating the root condition of insufficient logging.
AU-2 requires identification and logging of security-relevant event types, directly stopping omission of critical events.
AU-3 mandates that audit records contain the specific details needed to understand what occurred, preventing incomplete event descriptions.
AC-24 ensures access-control decisions are made and applied consistently, reducing the chance of an incorrect authorization result.
A reference monitor that is always invoked and tamper-proof forces every authorization decision through a verified, correct path.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Insufficient logging directly prevents generation of the incident data/metadata that RS.AN-07 requires, so the weakness starves collection/preservation completely in both directions.
Insufficient logging largely blinds event analysis by omitting the critical details needed to understand adverse activities.
Insufficient logging starves the multiple log sources and SIEM correlation that DE.AE-03 relies on, largely defeating its ability to operate while the logging gap removes most of the correlation outcome's value.
Insufficient logging starves impact/scope estimation of the event details required to produce accurate estimates, removing most of the outcome's value while leaving limited non-log avenues intact.
Insufficient logging starves DE.AE-06 of the event data that must be delivered to staff/tools, removing most of the outcome's value while the delivery mechanisms themselves remain intact.
Insufficient logging starves incident declaration of the event details needed to evaluate criteria, removing most of the outcome's efficacy in both directions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.
Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.
Mandating comprehensive event logging with user IDs, timestamps, and access attempts directly eliminates the absence of audit trails that would otherwise allow undetected exploitation.
By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.
Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.
By explicitly transferring security roles and responsibilities when personnel change jobs or leave, the control reduces the chance that former employees retain access rights they no longer need, thereby limiting improper access control.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (6 rules)
- V-248581 OL 8 must require users to provide a password for privilege escalation. prevents CWE-863
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. prevents CWE-284
- V-248598 There must be no ".shosts" files on the OL 8 operating system. prevents CWE-284
Oracle Linux 9 (3 rules)
- V-271758 OL 9 file systems must not contain .shosts files. prevents CWE-284
- V-271579 OL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. prevents CWE-778
- V-271757 OL 9 file systems must not contain shosts.equiv files. prevents CWE-284
RHEL 7 (3 rules)
- V-204430 The Red Hat Enterprise Linux operating system must be configured so that users must re-authenticate for privilege escalation. prevents CWE-863
- V-204606 The Red Hat Enterprise Linux operating system must not contain .shosts files. prevents CWE-284
- V-204607 The Red Hat Enterprise Linux operating system must not contain shosts.equiv files. prevents CWE-284
RHEL 8 (7 rules)
- V-230390 The RHEL 8 System must take appropriate action when an audit processing failure occurs. prevents CWE-778
- V-230283 There must be no shosts.equiv files on the RHEL 8 operating system. prevents CWE-284
- V-230284 There must be no .shosts files on the RHEL 8 operating system. prevents CWE-284
RHEL 9 (1 rule)
- V-258153 RHEL 9 audit system must take appropriate action when an error writing to the audit storage volume occurs. prevents CWE-778