Executive brief
Juju is an open-source orchestration engine used to deploy and manage software applications across various cloud environments. A vulnerability in its secret management system allows a malicious application to guess the identifiers of secrets belonging to other applications. If successful, an attacker could trick a shared service into accessing or modifying sensitive data it shouldn't have access to, potentially leading to data theft or unauthorized system changes.
Technical details
Juju is affected by an Insecure Direct Object Reference (IDOR) vulnerability within its Secrets management component. The vulnerability stems from two primary weaknesses: the use of predictable XID-based secret identifiers and the inability of a 'grantee' application to verify the provenance or owner of a granted secret. An attacker with high privileges can guess the secret ID of a victim application and pass it to a shared 'provider' application (the confused deputy). Because the provider cannot verify if the secret ID originated from the expected relation, it may perform operations using the victim's secret on behalf of the attacker. This can lead to the exfiltration or mutation of sensitive resources. A fix is available in version 0.0.0-20260319091847-d06919eb03ec.
Affected products
- Canonical Juju >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec
Timeline
- 2026-03-18: disclosed
- 2026-03-18: patched
- 2026-03-19: advisory