5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32691

CVE-2026-32691: Juju affected by timing ownership claim attack on new external back-end secrets

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.

Impact

Between generating a Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision.

Patches

3.6.19

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32691

CVE-2026-32691:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/juju/juju	go	>= 3.0.0, < 3.6.19	3.6.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition in Juju's secret management subsystem, allowing an authenticated unit agent to claim ownership of a newly created secret. The root cause of this vulnerability lies in the state.State.findSecretEntity function, which failed to correctly resolve the owning entity for secrets associated with units in a remote application. This flaw would cause the system to believe a secret was unowned, opening a window for an attacker to claim it.

The primary evidence for this is the patch applied to findSecretEntity in state/secrets.go. The change introduces logic to look up the remote application if a unit is not found locally. This ensures that the ownership of a secret is correctly determined even for remote units, closing the race condition window.

A secondary, related change was made in the state.State.GrantSecretAccess function. This function was patched to explicitly forbid granting secret access to units in a remote application. This change serves as a defense-in-depth measure, further securing the secret management system by preventing a potential vector for unauthorized access.

Vulnerable functions

State.findSecretEntity

state/secrets.go

The `findSecretEntity` function is vulnerable because it fails to correctly identify the owner of a secret associated with a remote unit. When a secret is being created for a remote unit, this function would incorrectly return a 'not found' error. This allows an attacker to exploit a race condition and claim ownership of the secret before the legitimate owner can. The patch fixes this by adding logic to resolve the remote application associated with the unit, ensuring the correct owner is identified.

State.GrantSecretAccess

state/secrets.go

The `GrantSecretAccess` function was modified to harden security around secret sharing with remote units. The original implementation had complex logic to check if a unit belonged to a remote application, which could potentially be bypassed. The patch simplifies this check by relying on the `subjectCollName` returned by the patched `findSecretEntity` function. This change prevents a unit from a remote model from being granted access to a secret, which could have been another vector for this vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.