Canonical Juju up to 3.6.18 predictable value

Summaryinfo

A vulnerability has been found in Canonical Juju up to 3.6.18 and classified as problematic. This affects an unknown part. This manipulation causes predictable value. The identification of this vulnerability is CVE-2026-32694. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Canonical Juju up to 3.6.18. It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a predictable value vulnerability. The CWE definition for the vulnerability is CWE-343. The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated. As an impact it is known to affect confidentiality. The summary by CVE is:

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker.

The weakness was shared by Dima Tisnek. The advisory is shared at github.com. This vulnerability is known as CVE-2026-32694 since 03/13/2026. The exploitation appears to be difficult. The attack can be launched remotely. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

Upgrading to version 3.6.19 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-12823). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Canonical

Name

• Juju

Version

• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.11
• 3.6.12
• 3.6.13
• 3.6.14
• 3.6.15
• 3.6.16
• 3.6.17
• 3.6.18

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion