CVE-2026-32694: canonical juju

Vulnerability summary

CVE-2026-32694 is a medium (CVSS 6.6) vulnerability in canonical juju. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-03-2026
   PublishedVulnerability first disclosed.
2. 18-03-2026
   Last modifiedVulnerability information updated.

Description

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.

• CWE-343Predictable Value Range from Previous ValuesThe product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.