CVE-2026-32694
Description
In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.
How to fix
- canonical juju3.6.19 or later
- github.com/juju/juju0.0.0-20260319091847-d06919eb03ec or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canonical juju | 3.0.0 ≤ v < 3.6.19 | 3.6.19 |
| github.com/juju/jujuGo | 0.0.0-20221021155847-35c560704ee2 ≤ v < 0.0.0-20260319091847-d06919eb03ec | 0.0.0-20260319091847-d06919eb03ec |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.