# CVE-2026-32694: Canonical Juju IDOR in Juju Secrets

Source: https://junglewise.ai/threats/cve-2026-32694-canonical-juju-idor-in-juju-secrets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-32694 · Severity: medium · CVSS 6.6 · Published 2026-03-19

Juju is an open-source orchestration engine used to deploy and manage software applications across various cloud environments. A vulnerability in its secret management system allows a malicious application to guess the identifiers of secrets belonging to other applications. If successful, an attacker could trick a shared service into accessing or modifying sensitive data it shouldn't have access to, potentially leading to data theft or unauthorized system changes.

Technologies: [Canonical Juju](https://junglewise.ai/threats/technologies/juju), [github.com/juju/juju (Go)](https://junglewise.ai/threats/technologies/github-com-juju-juju). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-32694 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32694 being exploited in the wild.

**How severe is CVE-2026-32694?** Medium severity, with a CVSS score of 6.6, published 19 March 2026.

**Which products and versions are affected?** Canonical Juju >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec; github.com/juju/juju (Go) >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec, SEMVER:introduced=0.0.0-20221021155847-35c560704ee2,fixed=0.0.0-20260319091847-d06919eb03ec.

**Is there a fix for CVE-2026-32694?** Yes. github.com/juju/juju (Go): upgrade to 0.0.0-20260319091847-d06919eb03ec or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32694 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32694?** Check whether you run Canonical Juju or github.com/juju/juju (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/juju/juju (Go): upgrade to 0.0.0-20260319091847-d06919eb03ec or later

  ```sh
  go get github.com/juju/juju@v0.0.0-20260319091847-d06919eb03ec
  ```


## Technical details

Juju is affected by an Insecure Direct Object Reference (IDOR) vulnerability within its Secrets management component. The vulnerability stems from two primary weaknesses: the use of predictable XID-based secret identifiers and the inability of a 'grantee' application to verify the provenance or owner of a granted secret. An attacker with high privileges can guess the secret ID of a victim application and pass it to a shared 'provider' application (the confused deputy). Because the provider cannot verify if the secret ID originated from the expected relation, it may perform operations using the victim's secret on behalf of the attacker. This can lead to the exfiltration or mutation of sensitive resources. A fix is available in version 0.0.0-20260319091847-d06919eb03ec.

## Affected products

- Canonical Juju >= 0.0.0-20221021155847-35c560704ee2, < 0.0.0-20260319091847-d06919eb03ec

## Identifiers

- CVE-2026-32694
- GHSA-5cj2-rqqf-hx9p
- GO-2026-4778

## Timeline

- 2026-03-18: disclosed
- 2026-03-18: patched
- 2026-03-19: advisory

## References

- [https://api.github.com/users/dimaqq](https://api.github.com/users/dimaqq)
- [https://github.com/dimaqq](https://github.com/dimaqq)
- [https://api.github.com/users/dimaqq/gists%7B/gist_id%7D](https://api.github.com/users/dimaqq/gists%7B/gist_id%7D)
- [https://api.github.com/users/dimaqq/repos](https://api.github.com/users/dimaqq/repos)
- [https://avatars.githubusercontent.com/u/662249?v=4](https://avatars.githubusercontent.com/u/662249?v=4)
- [https://api.github.com/users/dimaqq/events%7B/privacy%7D](https://api.github.com/users/dimaqq/events%7B/privacy%7D)

## Related threats

- [Canonical Juju missing authorization in unit resources download](https://junglewise.ai/threats/cve-2026-93336-missing-authorization-in-the-unit-resources-download-route-in)
- [Canonical Juju race condition in API server userTokens map](https://junglewise.ai/threats/cve-2026-5774-canonical-juju-race-condition-in-api-server-usertokens-map)
- [Canonical Juju improper authorization in Controller facade](https://junglewise.ai/threats/cve-2026-5412-canonical-juju-improper-authorization-in-controller-facade)
- [Canonical Juju incorrect authorization in resource handler](https://junglewise.ai/threats/cve-2025-68153-canonical-juju-incorrect-authorization-in-resource-handler)
- [Canonical Juju Incorrect Authorization in Debug Log Endpoint](https://junglewise.ai/threats/cve-2025-68152-canonical-juju-incorrect-authorization-in-debug-log-endpoint)