https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:44:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276425 EUVD-2026-276425 https://cve.radiocsirt.org/vuln/euvd-2026-276425 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32693 <p>In Juju from version 3.0.0 through 3.6.18, the authorization of the &#34;secret-set&#34; tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the &#34;secret-set&#34; tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.</p> <p>In Juju from version 3.0.0 through 3.6.18, the authorization of the &#34;secret-set&#34; tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the &#34;secret-set&#34; tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32693 https://cve.radiocsirt.org/vuln/ghsa-439w-v2p7-pggc <p><strong>Affected:</strong> Go: github.com/juju/juju</p> <p>### Summary</p> <p>Grantee is able to update secret content using the `secret-set` tool due to broad Kubernetes access policy. Implications are that it is possible, knowing a Kubernetes secret identifier (e.g. name), to patch without affecting the secret, revealing the value, or, patching while affecting the secrets value.</p> <p>### Details</p> <p>When a Juju secret is &#34;granted&#34; to an app, that app should be able to read the secret content but not modify it, and should be able to only read secrets that have been granted to it.</p> <p>Authorization of the `secret-set` hook tool / controller request is not performed correctly, which allows the grantee to update the secret content and to read or affect other secrets.</p> <p>### PoC</p> <p>Tested: - two applications in the same controller, same model: one owns the secret, another get a grant - relation between them - secret grant - Linux AMD64, Canonical K8s, Juju 3.6.8 controller, Juju 3.6.9 CLI</p> <p>Not tested: - admin (user) secrets - cross-model relations - cross-controller relations</p> <p>```command ⋊&gt; dima@bb ⋊&gt; /c/hexanator on main ◦ juju exec --unit ingress2/0 &#34;secret-add nice=little-value&#34; secret://9cf1319c-4f4b-44f8-891b-9d1c7d8d3b52/d350nbnmp25c76301ht0 ⋊&gt; dima@bb ⋊&gt; /c/hexanator on main ◦ juju show-unit ingress2/0 ingress2/0: workload-version: 24.2.0 opened-ports: [] charm: ch:amd64/nginx-ingress-integrator-203 leader: true life: alive relation-info: - relation-id: 11 endpoint: ingress related-endpoint: ingress application-data: {}…</p> <p><strong>Affected:</strong> Go: github.com/juju/juju</p> <p>### Summary</p> <p>Grantee is able to update secret content using the `secret-set` tool due to broad Kubernetes access policy. Implications are that it is possible, knowing a Kubernetes secret identifier (e.g. name), to patch without affecting the secret, revealing the value, or, patching while affecting the secrets value.</p> <p>### Details</p> <p>When a Juju secret is &#34;granted&#34; to an app, that app should be able to read the secret content but not modify it, and should be able to only read secrets that have been granted to it.</p> <p>Authorization of the `secret-set` hook tool / controller request is not performed correctly, which allows the grantee to update the secret content and to read or affect other secrets.</p> <p>### PoC</p> <p>Tested: - two applications in the same controller, same model: one owns the secret, another get a grant - relation between them - secret grant - Linux AMD64, Canonical K8s, Juju 3.6.8 controller, Juju 3.6.9 CLI</p> <p>Not tested: - admin (user) secrets - cross-model relations - cross-controller relations</p> <p>```command ⋊&gt; dima@bb ⋊&gt; /c/hexanator on main ◦ juju exec --unit ingress2/0 &#34;secret-add nice=little-value&#34; secret://9cf1319c-4f4b-44f8-891b-9d1c7d8d3b52/d350nbnmp25c76301ht0 ⋊&gt; dima@bb ⋊&gt; /c/hexanator on main ◦ juju show-unit ingress2/0 ingress2/0: workload-version: 24.2.0 opened-ports: [] charm: ch:amd64/nginx-ingress-integrator-203 leader: true life: alive relation-info: - relation-id: 11 endpoint: ingress related-endpoint: ingress application-data: {}…</p> https://cve.radiocsirt.org/vuln/ghsa-439w-v2p7-pggc