CVE-2026-32694

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32694", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-03-13T12:53:34.544Z", "datePublished": "2026-03-18T12:55:42.948Z", "dateUpdated": "2026-03-18T13:40:33.981Z"}, "containers": {"cna": {"title": "Insecure Direct Object Reference attack via predictable secret ID in Juju", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-343", "description": "CWE-343 Predictable value range from previous values", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59: Session Credential Falsification through Prediction"}]}], "affected": [{"vendor": "Canonical", "product": "Juju", "platforms": ["Linux"], "collectionURL": "https://github.com/juju/", "packageName": "juju", "repo": "https://github.com/juju/juju", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.6.19", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker."}], "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p", "tags": ["vendor-advisory", "vdb-entry"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Dima Tisnek", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-03-18T12:55:42.948Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T13:39:10.787656Z", "id": "CVE-2026-32694", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T13:40:33.981Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32694", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-18T13:39:10.787656Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T13:40:00.568Z"}}], "cna": {"title": "Insecure Direct Object Reference attack via predictable secret ID in Juju", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dima Tisnek"}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59: Session Credential Falsification through Prediction"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/juju/juju", "vendor": "Canonical", "product": "Juju", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.6.19", "versionType": "semver"}], "platforms": ["Linux"], "packageName": "juju", "collectionURL": "https://github.com/juju/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p", "tags": ["vendor-advisory", "vdb-entry"]}], "descriptions": [{"lang": "en", "value": "In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-343", "description": "CWE-343 Predictable value range from previous values"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization bypass through User-Controlled key"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-03-18T12:55:42.948Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32694", "state": "PUBLISHED", "dateUpdated": "2026-03-18T13:40:33.981Z", "dateReserved": "2026-03-13T12:53:34.544Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-03-18T12:55:42.948Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/juju/", "defaultStatus": "unaffected", "packageName": "juju", "platforms": ["Linux"], "product": "Juju", "repo": "https://github.com/juju/juju", "vendor": "Canonical", "versions": [{"lessThan": "3.6.19", "status": "affected", "version": "3.0.0", "versionType": "semver"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BAFE599-DF11-429B-9A8C-970BDB3065C8", "versionEndExcluding": "3.6.19", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker."}, {"lang": "es", "value": "En Juju desde la versi\u00f3n 3.0.0 hasta la 3.6.18, cuando un propietario de secreto otorga permisos a un secreto a un beneficiario, el propietario del secreto se basa exclusivamente en un XID predecible del secreto para verificar la propiedad. Esto permite a un beneficiario malicioso que puede solicitar secretos predecir secretos pasados otorgados por el mismo propietario de secreto a diferentes beneficiarios, permiti\u00e9ndoles usar los recursos otorgados por esos secretos pasados. La explotaci\u00f3n exitosa se basa en una configuraci\u00f3n muy espec\u00edfica, una sem\u00e1ntica de datos espec\u00edfica y en que el administrador tenga la necesidad de desplegar al menos dos aplicaciones diferentes, una de ellas controlada por el atacante."}], "id": "CVE-2026-32694", "lastModified": "2026-06-17T10:36:13.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32694", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T13:39:10.787656Z", "version": "2.0.3"}}]}, "published": "2026-03-18T14:16:40.503", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-343"}, {"lang": "en", "value": "CWE-639"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.6.19)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Juju", "source": "cna", "vendor": "Canonical"}, "product": "juju", "vendor": "canonical"}], "analysis": {"en": {"generated_at": "2026-03-19T17:23:19.880373+00:00", "value": {"mitigation_remediation": ["Apply Canonical\u2019s official patch or upgrade Juju to a version newer than 3.6.18.", "If an immediate patch is unavailable, remove the \u201cgrant permissions\u201d capability from attacker-controlled applications so they cannot request or list secrets.", "Continuously monitor Canonical\u2019s security advisories for updated patches and apply them promptly."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Secret Access"}, "threat_synthesis": {"affected_systems": "Canonical Juju 3.0.0 through 3.6.18 are affected. No other vendors or product versions are listed as impacted in the CNA data.", "description_and_impact": "A vulnerability in Juju versions 3.0.0 through 3.6.18 allows a grantee that has permission to request secrets to leverage a predictable secret identifier (XID) and infer secrets that have been granted to other grantees by the same owner. This flaw is an instance of Improper Assertion of Permissions (CWE\u2011343) and Information Exposure Through Collection of Account Information (CWE\u2011639). The attacker can then use those inferred secrets to access resources and configurations that should be restricted, potentially leading to unauthorized configuration changes or data exposure.", "risk_and_exploitability": "The CVSS score of 6.6 indicates moderate severity, while an EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires that the attacker be a grantee with permission to request secrets, that a system administrator has deployed at least two separate applications (one under attacker control), and that the attacker can generate or request secrets using the predictable XID pattern. Therefore the attack vector is constrained but still poses a tangible risk of unauthorized secret access."}}}}, "created": "2026-03-19T08:56:39.603620+00:00", "updated": "2026-03-24T10:58:47.259072+00:00", "vendors": ["canonical", "canonical$PRODUCT$juju"]}