Is CVE-2026-32694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32694 being exploited in the wild.

How severe is CVE-2026-32694?

Medium severity, with a CVSS score of 6.6, published 19 March 2026.

Which products and versions are affected?

Canonical Juju >= 0.0.0-20221021155847-35c560704ee2, = 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec, SEMVER:introduced=0.0.0-20221021155847-35c560704ee2,fixed=0.0.0-20260319091847-d06919eb03ec.

Is there a fix for CVE-2026-32694?

Yes. github.com/juju/juju (Go): upgrade to 0.0.0-20260319091847-d06919eb03ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32694 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-32694?

Check whether you run Canonical Juju or github.com/juju/juju (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32694: Canonical Juju IDOR in Juju Secrets

Q: Is there a fix for CVE-2026-32694?

Yes. github.com/juju/juju (Go): upgrade to 0.0.0-20260319091847-d06919eb03ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32694 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-32694?

Check whether you run Canonical Juju or github.com/juju/juju (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32694 · Severity: medium · CVSS 6.6 · Published 2026-03-19

Juju is an open-source orchestration engine used to deploy and manage software applications across various cloud environments. A vulnerability in its secret management system allows a malicious application to guess the identifiers of secrets belonging to other applications. If successful, an attacker could trick a shared service into accessing or modifying sensitive data it shouldn't have access to, potentially leading to data theft or unauthorized system changes.

Technologies: Canonical Juju, github.com/juju/juju (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2026-32694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32694 being exploited in the wild.
How severe is CVE-2026-32694?: Medium severity, with a CVSS score of 6.6, published 19 March 2026.
Which products and versions are affected?: Canonical Juju >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec; github.com/juju/juju (Go) >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec, SEMVER:introduced=0.0.0-20221021155847-35c560704ee2,fixed=0.0.0-20260319091847-d06919eb03ec.
Is there a fix for CVE-2026-32694?: Yes. github.com/juju/juju (Go): upgrade to 0.0.0-20260319091847-d06919eb03ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32694 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-32694?: Check whether you run Canonical Juju or github.com/juju/juju (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/juju/juju (Go): upgrade to 0.0.0-20260319091847-d06919eb03ec or later
```
go get github.com/juju/juju@v0.0.0-20260319091847-d06919eb03ec
```

Technical details

Juju is affected by an Insecure Direct Object Reference (IDOR) vulnerability within its Secrets management component. The vulnerability stems from two primary weaknesses: the use of predictable XID-based secret identifiers and the inability of a 'grantee' application to verify the provenance or owner of a granted secret. An attacker with high privileges can guess the secret ID of a victim application and pass it to a shared 'provider' application (the confused deputy). Because the provider cannot verify if the secret ID originated from the expected relation, it may perform operations using the victim's secret on behalf of the attacker. This can lead to the exfiltration or mutation of sensitive resources. A fix is available in version 0.0.0-20260319091847-d06919eb03ec.

Affected products

Canonical Juju >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec

Identifiers

CVE-2026-32694
GHSA-5cj2-rqqf-hx9p
GO-2026-4778

Timeline

2026-03-18: disclosed
2026-03-18: patched
2026-03-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.