Race Condition Vulnerability in Juju Secrets Management by Canonical

CVE-2026-32691

What is CVE-2026-32691?

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. This occurs during the window between the generation of a Juju Secret ID and the creation of the secret's first revision, enabling an attacker to seize ownership of a known secret. Consequently, the attacking unit gains the ability to read the content of the initial secret revision, potentially exposing sensitive information.

References