Skip to content
Fencer Vulns
medium 6.6

CVE-2026-32694 json

Insecure Direct Object Reference attack via predictable secret ID in Juju

published 2026-03-18 7 mo ago modified 2026-06-17 4 mo ago also GHSA-5cj2-rqqf-hx9p , GO-2026-4778 , EUVD-2026-12823

cvss
6.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.

Patch / fix

  • go github.com/juju/juju 0.0.0-20260319091847-d06919eb03ec
  • Canonical Juju 3.6.19
  • govulncheck-vulndb openSUSE Leap 15.6 0.0.20260326T203309-150000.1.155.2

suse advisories SUSE-SU-2026:1135-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/juju/juju
>=0.0.0-20221021155847-35c560704ee2, <0.0.0-20260319091847-d06919eb03ec
0.0.0-20260319091847-d06919eb03ec

Affected products

  • Canonical Juju

Classification

Weakness
  • CWE-343 Predictable Value Range from Previous Values
  • CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.