CVE-2026-32694: Canonical Juju Information Disclosure Flaw

CVE-2026-32694 Overview

CVE-2026-32694 is a predictable identifier vulnerability affecting Canonical Juju versions 3.0.0 through 3.6.18. The vulnerability exists in Juju's secret management system, where a secret owner grants permissions to a secret grantee using a predictable XID (external identifier) to verify ownership. This design flaw allows a malicious grantee with the ability to request secrets to predict past secrets granted by the same secret owner to different grantees, potentially enabling unauthorized access to resources associated with those previously granted secrets.

Critical Impact

A malicious grantee could exploit predictable secret identifiers to access resources belonging to other applications deployed by the same administrator, potentially leading to unauthorized data access, configuration manipulation, or compromise of other deployed workloads.

Affected Products

• Canonical Juju versions 3.0.0 through 3.6.18

Discovery Timeline

• 2026-03-18 - CVE-2026-32694 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-32694

Vulnerability Analysis

This vulnerability is classified under CWE-343 (Predictable Value Range from Previous Values), indicating a fundamental weakness in the cryptographic or randomization approach used for generating secret identifiers. The core issue lies in how Juju's secret management system generates and validates secret ownership through XIDs.

When a secret owner grants permissions to a grantee in Juju, the system relies exclusively on the XID of the secret for ownership verification. The predictable nature of these XIDs means that an attacker who has been granted access to any secret can potentially reverse-engineer or predict the XIDs of secrets granted to other grantees by the same owner.

Successful exploitation requires a network-accessible attack path with high attack complexity. The attacker must have high privileges (being a legitimate grantee in the Juju deployment) and the target environment must have a very specific configuration with particular data semantics. Additionally, the administrator must have deployed at least two different applications, with one of them under the attacker's control.

Root Cause

The root cause of CVE-2026-32694 is the use of predictable identifiers for secret ownership verification in Juju's secret management subsystem. Rather than using cryptographically secure random identifiers or implementing additional authorization checks beyond XID verification, the system relies on a predictable sequence or pattern for generating secret XIDs. This allows an attacker with knowledge of one XID to calculate or predict other XIDs generated by the same secret owner.

Attack Vector

The attack vector for CVE-2026-32694 is network-based, requiring the attacker to be a legitimate participant in the Juju deployment. The attack flow proceeds as follows:

1. The attacker deploys a malicious application within a Juju environment where the administrator manages multiple applications
2. The administrator grants a secret to the attacker's application using Juju's secret management
3. The attacker observes the XID pattern of the granted secret
4. Using this information, the attacker predicts XIDs of secrets previously granted to other legitimate grantees by the same owner
5. The attacker crafts requests using the predicted XIDs to access resources associated with those secrets

The vulnerability mechanism relies on the deterministic or weakly-random nature of XID generation. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-32694

Indicators of Compromise

• Unusual secret access patterns where a single grantee application queries for multiple secrets not explicitly granted to it
• Failed authentication attempts using predicted or guessed secret XIDs in Juju controller logs
• Anomalous API calls to the secret management endpoints from applications that should not require access to certain secrets

Detection Strategies

• Monitor Juju controller logs for secret access requests that fail validation, which may indicate prediction attempts
• Implement audit logging for all secret grant and access operations to establish baseline behavior
• Deploy SentinelOne Singularity Platform to detect unauthorized access patterns and anomalous application behavior within Juju-managed infrastructure

Monitoring Recommendations

• Enable verbose logging on Juju controllers to capture detailed secret management operations
• Establish alerting for secret access from applications outside their normal operational scope
• Review deployed application configurations to identify any potentially malicious or compromised charms

How to Mitigate CVE-2026-32694

Immediate Actions Required

• Upgrade Canonical Juju to a patched version beyond 3.6.18 as soon as patches are available from Canonical
• Audit existing secret grants to identify any unauthorized access that may have already occurred
• Review deployed applications to ensure no malicious or untrusted charms have been deployed in environments with sensitive secrets

Patch Information

Canonical has acknowledged this vulnerability through their GitHub Security Advisory (GHSA-5cj2-rqqf-hx9p). Administrators should monitor this advisory for official patch releases and upgrade instructions. The fix will likely involve implementing cryptographically secure random XID generation and additional ownership verification mechanisms.

Workarounds

• Limit secret sharing to only explicitly trusted applications until a patch is applied
• Avoid deploying untrusted or third-party charms in environments where sensitive secrets are managed
• Implement network segmentation to isolate Juju controllers and limit access to secret management APIs
• Consider rotating existing secrets after applying the patch to invalidate any potentially compromised credentials

# Review current secret grants in Juju
juju secrets --format=yaml

# List all deployed applications to audit for untrusted charms
juju status --format=yaml | grep -A5 "application-status"

# Monitor Juju controller logs for suspicious secret access
juju debug-log --include unit-* --replay | grep -i "secret"