An authorization bypass vulnerability in Canonical Juju allows authenticated unit agents to poison secret revisions, posing a significant risk to sensitive data integrity.

This is an improper authorization vulnerability (CWE-285) within the Vault secrets back-end implementation. It allows an already authenticated unit agent to modify secret revisions beyond their intended scope.

Successful exploitation of this vulnerability permits an attacker to poison existing secrets, which could lead to unauthorized data access, service disruption, or the compromise of downstream systems relying on those secrets. With a CVSS score of 7.6, the vulnerability is classified as High severity, reflecting the potential for significant impact on the confidentiality and integrity of the secret management infrastructure.

Immediate Action: Update Canonical Juju to the patched version identified in the upstream fix, specifically the commit version 0.0.0-20260319091847-d06919eb03ec.

Proactive Monitoring: Review Juju access logs for unusual unit agent activity or unauthorized attempts to modify secret revisions.

Compensating Controls: Ensure strict adherence to the principle of least privilege for unit agents and implement auditing on all secret management operations to detect unauthorized changes.

Public Exploit Available: Unknown

Given the High severity of this authorization bypass, administrators should prioritize updating Juju instances to the latest secure version. Immediate remediation is necessary to prevent potential secret poisoning and ensure the continued integrity of vault-managed credentials within the infrastructure.