Juju CVE-2026-32694

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack surface but high attack complexity and high privilege requirements, which significantly constrains real-world exploitability. The vulnerability requires: (1) the attacker to possess high privileges within the Juju environment, (2) the ability to control or influence at least one deployed application, (3) specific data semantics and configuration patterns, and (4) the administrator to deploy multiple distinct applications. These constraints substantially reduce EPSS exploitation probability below what the CVSS score alone suggests. This is not an actively exploited vulnerability in the wild (no KEV listing indicated), and no public proof-of-concept has been widely circulated. However, the fundamental design flaw—using predictable identifiers for secret ownership—represents a serious architectural weakness that could be exploited in targeted attacks against high-value Juju deployments by sophisticated, privileged threat actors. Priority should be moderate-to-high for organizations using Juju in sensitive environments, but this is not an emergency patch for most deployments.

An attacker with a compromised or malicious application deployed within a Juju environment observes the predictable XID pattern when their application receives a secret grant from the administrator. Using this pattern, the attacker extracts or reverse-engineers the XIDs of previously granted secrets intended for other legitimate applications (e.g., database credentials granted to a different service). The attacker then requests these predicted secret identifiers, successfully bypassing access controls and obtaining sensitive credentials or configuration data not intended for their application. This attack is feasible only within a multi-tenant or multi-application Juju deployment where the attacker has some foothold and the administrator has performed multiple secret grants to different recipients.