Unauthorized Secret Access in Juju by Canonical
CVE-2026-32694

6.6MEDIUM

Key Information:

Vendor

Canonical

Status
Juju
Vendor
CVE Published:
18 March 2026

What is CVE-2026-32694?

In Juju versions from 3.0.0 to 3.6.18, a flaw allows secret owners to grant permissions based solely on a predictable secret ID (XID). This weakness may enable malicious actors to predict prior secrets owned by the same secret owner, potentially jeopardizing sensitive resources. The risk increases if an administrator deploys multiple applications, especially those controlled by an attacker, exploiting the specific configuration and unique data semantics in play.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Juju Linux 3.0.0 < 3.6.19

References

https://github.com/juju/juju/security/advisories/GHSA-5cj...
vendor-advisoryvdb-entry

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dima Tisnek
JSON
.