CVE-2026-32694 Overview
CVE-2026-32694 affects Canonical Juju versions 3.0.0 through 3.6.18. The vulnerability stems from secret owners relying exclusively on a predictable transaction identifier (XID) to verify ownership when granting secret access to grantees. A malicious grantee with permission to request secrets can predict XIDs of past secrets granted to other grantees by the same owner. This enables unauthorized access to resources protected by those secrets. The flaw is classified under [CWE-343: Predictable Value Range from Previous Values]. Exploitation requires a specific deployment configuration where an administrator runs at least two applications, with one controlled by the attacker.
Critical Impact
Authenticated grantees can predict secret XIDs to access resources protected by secrets granted to other applications, breaching tenant isolation in multi-application Juju deployments.
Affected Products
- Canonical Juju 3.0.0 through 3.6.18
- Juju controllers managing multi-application secret sharing
- Deployments using Juju secret grants across multiple grantees
Discovery Timeline
- 2026-03-18 - CVE-2026-32694 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-32694
Vulnerability Analysis
Juju is Canonical's application modeling and orchestration tool used to deploy and manage workloads across cloud and on-premises infrastructure. The platform includes a secrets subsystem that allows charms to share sensitive values such as credentials and tokens between applications. Owners grant access to specific grantees through scoped permissions.
The authorization check for secret access uses the secret's XID as the trust anchor. Because the XID follows a predictable generation pattern, an attacker who controls one grantee can enumerate or guess the XIDs of secrets granted previously to other grantees. The system accepts these guessed identifiers as proof of authorization without performing an independent ownership or access control validation.
Root Cause
The root cause is improper randomness in security-critical identifiers, mapped to [CWE-343]. The implementation treats the XID as both an opaque reference and an authorization token, conflating identification with authentication. Predictable identifiers should never substitute for explicit access control checks tied to the requesting principal.
Attack Vector
Exploitation requires the attacker to control a grantee application deployed alongside a victim application under the same secret owner. The attacker requests secrets using predicted XIDs and receives resources intended for other grantees. The attack vector is network-based but requires high privileges and high attack complexity due to the specific configuration prerequisites. See the GitHub Security Advisory GHSA-5cj2-rqqf-hx9p for vendor-confirmed technical details.
No verified proof-of-concept code is publicly available. The vulnerability mechanism centers on the predictability of the XID generation algorithm rather than a memory-corruption primitive.
Detection Methods for CVE-2026-32694
Indicators of Compromise
- Unexpected secret access requests from grantee units to XIDs they were not directly granted
- Juju controller audit log entries showing secret reads from applications outside the original grant scope
- Sequential or pattern-matching XID lookups originating from a single application unit
Detection Strategies
- Review Juju controller logs for secret-get operations that reference secret URIs not present in that unit's grant table
- Correlate the requesting application identity with the grant ledger to identify unauthorized resolution attempts
- Establish baseline secret access patterns per application and alert on deviations
Monitoring Recommendations
- Enable verbose audit logging on the Juju controller and forward events to a centralized analytics platform
- Monitor for newly deployed applications that immediately issue high volumes of secret lookups
- Track grant and revoke events alongside subsequent access patterns to identify replay against rotated secrets
How to Mitigate CVE-2026-32694
Immediate Actions Required
- Upgrade Juju controllers and clients to a version newer than 3.6.18 that addresses CVE-2026-32694
- Audit existing secret grants and revoke access from any application whose trust posture has changed
- Rotate secrets that may have been exposed to untrusted grantees in vulnerable deployments
Patch Information
Canonical published guidance through the Juju GitHub Security Advisory GHSA-5cj2-rqqf-hx9p. Operators should consult the advisory for the fixed release version and upgrade procedures specific to their controller topology.
Workarounds
- Avoid deploying untrusted or attacker-controlled applications alongside applications holding sensitive secrets under the same owner
- Limit secret grants to the minimum set of grantees required for functional operation
- Rotate secrets frequently so that any predicted XIDs reference values no longer in use
# Check the running Juju controller version
juju version
# Review current secret grants across the model
juju secrets --format yaml
# Revoke a secret grant from a suspect application
juju secret-revoke <secret-uri> --app <grantee-application>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.