CVE-2026-32691: Timing ownership claim attack on new external back-end secrets
A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32691?
CVE-2026-32691 is categorized as a high severity vulnerability due to its potential for exploitation through a race condition.
How do I fix CVE-2026-32691?
To mitigate CVE-2026-32691, upgrade Juju to version 3.6.19 or later, where this vulnerability has been addressed.
What software versions are affected by CVE-2026-32691?
CVE-2026-32691 affects Juju versions from 3.0.0 up to and including 3.6.18.
What type of attack does CVE-2026-32691 facilitate?
CVE-2026-32691 allows an authenticated unit agent to perform a timing ownership claim attack on newly initialized secrets.
Who can exploit CVE-2026-32691?
Only authenticated unit agents with access to the Juju environment can exploit CVE-2026-32691.