CVE-2026-32694 | Canonical Juju up to 3.6.18 predictable value

VDB-351529 · CVE-2026-32694 · EUVD-2026-12823 CANONICAL JUJU UP TO 3.6.18 PREDICTABLE VALUE HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 4.3 $0-$5k 0.60+ Summaryinfo A vulnerability has been found in Canonical Juju up to 3.6.18 and classified as problematic. This affects an unknown part. This manipulation causes predictable value. The identification of this vulnerability is CVE-2026-32694. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded. Detailsinfo A vulnerability was found in Canonical Juju up to 3.6.18. It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a predictable value vulnerability. The CWE definition for the vulnerability is CWE-343. The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated. As an impact it is known to affect confidentiality. The summary by CVE is: In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker. The weakness was shared by Dima Tisnek. The advisory is shared at github.com. This vulnerability is known as CVE-2026-32694 since 03/13/2026. The exploitation appears to be difficult. The attack can be launched remotely. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue. Upgrading to version 3.6.19 eliminates this vulnerability. The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-12823). Productinfo Vendor Canonical Name Juju Version 3.6.0 3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 3.6.6 3.6.7 3.6.8 3.6.9 3.6.10 3.6.11 3.6.12 3.6.13 3.6.14 3.6.15 3.6.16 3.6.17 3.6.18 License open-source CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 4.4 VulDB Meta Temp Score: 4.3 VulDB Base Score: 2.2 VulDB Temp Score: 2.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 6.6 CNA Vector (canonical): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Predictable value CWE: CWE-343 / CWE-342 / CWE-341 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Juju 3.6.19 Timelineinfo 03/13/2026 CVE reserved 03/18/2026 +5 days Advisory disclosed 03/18/2026 +0 days VulDB entry created 03/18/2026 +0 days VulDB entry last update Sourcesinfo Advisory: github.com Researcher: Dima Tisnek Status: Confirmed CVE: CVE-2026-32694 (🔒) GCVE (CVE): GCVE-0-2026-32694 GCVE (VulDB): GCVE-100-351529 EUVD: 🔒 Entryinfo Created: 03/18/2026 15:20 Updated: 03/18/2026 17:02 Changes: 03/18/2026 15:20 (64), 03/18/2026 17:02 (1) Complete: 🔍 Cache ID: 99:75C:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸