CVE-2026-32692CWE-285

Unauthorized update of out-of-scope Vault secrets

High · published March 18, 2026

CVSS v3.1
7.6
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.5th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-03-18T12:35Z
EPSS history
Timeline
  • 18 MAR 12:35Z
    Unauthorized update of out-of-scope Vault secrets
    cvelistv5