Unauthorized Secret Access in Juju by Canonical

CVE-2026-32694

What is CVE-2026-32694?

In Juju versions from 3.0.0 to 3.6.18, a flaw allows secret owners to grant permissions based solely on a predictable secret ID (XID). This weakness may enable malicious actors to predict prior secrets owned by the same secret owner, potentially jeopardizing sensitive resources. The risk increases if an administrator deploys multiple applications, especially those controlled by an attacker, exploiting the specific configuration and unique data semantics in play.

References