Read the docs
TI-2026-25186 Aliases CVE-2026-32694GHSA-5cj2-rqqf-hx9p

Insecure Direct Object Reference attack via predictable secret ID in Juju

Priority MEDIUM 64CWE-343Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00285 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Juju (Canonical): 3.6.19github.com/juju/juju (Go): 0.0.0-20260319091847-d06919eb03ec

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalJuju3.0.0 to before 3.6.193.6.19Patch availableCNA
—github.com/juju/juju (Go)0.0.0-20221021155847-35c560704ee2 to before 0.0.0-20260319091847-d06919eb03ec0.0.0-20260319091847-d06919eb03ecPatch availableGHSA-5cj2-rqqf-hx9p
  • Juju VendorCanonical Affected 3.0.0 to before 3.6.19 Fixed in 3.6.19 Patch available CNA
  • github.com/juju/juju (Go) Vendor— Affected 0.0.0-20221021155847-35c560704ee2 to before 0.0.0-20260319091847-d06919eb03ec Fixed in 0.0.0-20260319091847-d06919eb03ec Patch available GHSA-5cj2-rqqf-hx9p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*3.0.0 to before 3.6.19VulnerableCanonical
  • cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.6.19 Vulnerable ·Canonical

Remediation

  • Fix · CNA Juju (Canonical) Fixed in 3.6.19
  • Fix · GHSA-5cj2-rqqf-hx9p github.com/juju/juju (Go) Fixed in 0.0.0-20260319091847-d06919eb03ec Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Canonical Juju 3.6.19

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-25185 Unauthorized access to Kubernetes secrets in JujuPriority MEDIUM 40
    • TI-2026-25184 Unauthorized update of out-of-scope Vault secretsPriority LOW 32
    • TI-2026-25183 Timing ownership claim attack on new external back-end secretsPriority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32694
  2. 2026-10-03 Alias added: GHSA-5cj2-rqqf-hx9p

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-03806 Improper TLS Client/Server authentication and certificate verification on Database Cluster CVSS 3.1CRITICAL 10.0
  • TI-2025-33458 Zip slip vulnerability in Juju CVSS 3.1HIGH 8.8
  • TI-2025-00786 Arbitrary executable upload via authenticated endpoint CVSS 3.1HIGH 8.8
  • TI-2017-06681 Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket… CVSS 3.0CRITICAL 9.8
  • TI-2025-41733 Juju: Resource poisoning CVSS 4.0HIGH 7.1
  • TI-2025-33457 Sensitive log retrieval in Juju CVSS 3.1MEDIUM 6.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences