Juju Vault Secrets Back-End Authorization Bypass Vulnerability Allowing Unauthorized Secret Revision Updates

A vulnerability allowing authorization bypass in the Vault secrets back-end of Juju has been identified. This issue affects Juju versions 3.1.6 through 3.6.18. The vulnerability allows an authenticated unit agent to make unauthorized updates to secret revisions. With enough information, an attacker could manipulate and 'poison' existing secret revisions within the affected Vault back-end.

Impact

Exploitation of this vulnerability allows an authenticated unit agent to unauthorizedly update any secret revision in the Vault back-end used by the unit's model. This could lead to 'poisoning' of existing secret revisions, potentially causing harm depending on how those secrets are used.

Remediation

Users can upgrade to Juju version 3.6.19 to address this vulnerability.