5.3
Medium
CVE-2026-32691 A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated…
Description
A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Juju 3.0 | 3.0.0 → < 3.6.19 | 3.6.19 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Juju
The 13 CVEs of Juju →
CVE-2026-93336
Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a…
7.1
High
CVE-2026-5412
In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade
9.9
Critical
CVE-2026-5774
Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow…
6.1
Medium
CVE-2026-4370
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the…
10.0
Critical