CVE-2026-32694 Insecure Direct Object Reference attack via predictable secret ID in Juju
A malicious grantee can predict secret IDs to access resources from past secrets granted by the same owner in Juju.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32694?
CVE-2026-32694 is a medium-severity vulnerability in Canonical Juju, published on 18 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.
Which versions are affected by CVE-2026-32694?
3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juju/juju Go | From 0.0.0-20221021155847-35c560704ee2 | 0.0.0-20260319091847-d06919eb03ec |
github.com/juju/juju Go | From 0.0.0-20221021155847-35c560704ee2 | 0.0.0-20260319091847-d06919eb03ec |
github.com/juju/juju Go | From 0.0.0-20221021155847-35c560704ee2 | 0.0.0-20260319091847-d06919eb03ec |
Products include Canonical Juju.
How do I fix CVE-2026-32694?
Upgrade github.com/juju/juju to 0.0.0-20260319091847-d06919eb03ec or later.
Is CVE-2026-32694 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32694 exists.
Other vulnerabilities in Canonical Juju
- CVE-2026-4370 Improper TLS Client/Server authentication and certificate verification on Database Cluster
- CVE-2026-5412 Juju CloudSpec API could leak senstive information
- CVE-2017-9232 Juju uses a UNIX domain socket without setting appropriate permissions
- CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju
- CVE-2025-0928 Arbitrary executable upload via authenticated endpoint
Sources
Also known as GHSA-5cj2-rqqf-hx9p, GO-2026-4778.