CVE-2026-32691 Timing ownership claim attack on new external back-end secrets

What is CVE-2026-32691?

CVE-2026-32691 is a medium-severity vulnerability in Canonical Juju, published on 18 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.

Weakness: CWE-708

Which versions are affected by CVE-2026-32691?

3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.

Products include Canonical Juju.

How do I fix CVE-2026-32691?

Upgrade github.com/juju/juju to 3.6.19 or later.

Is CVE-2026-32691 being exploited?

There is no known exploitation of CVE-2026-32691 in the wild and no public exploit code.

Other vulnerabilities in Canonical Juju

• CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster Critical 10.0
• CVE-2026-5412 Juju CloudSpec API could leak senstive information Critical 9.9
• CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions Critical 9.8
• CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju High 8.8
• CVE-2025-0928 Arbitrary executable upload via authenticated endpoint High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gfgr-6hrj-85ww, GO-2026-4769.