CVE-2026-32694 - Vulnerability Analysis

Overview

Juju 3.0.0 through 3.6.18 contains a broken access control caused by predictable secret XID verification, letting malicious grantees access past secrets granted to other grantees, exploit requires specific configuration and multiple applications including attacker-controlled one.

Severity & Score

Impact

Malicious grantees can access resources granted by past secrets of other grantees, leading to unauthorized resource use.

Mitigation

Update to a version later than 3.6.18 or the latest available version.

References

• https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner