CVE-2026-32691: 
NixOS vulnerability analysis and mitigation

CVE-2026-32691 is a race condition vulnerability in the secrets management subsystem of Canonical's Juju orchestration software, enabling a "timing ownership claim attack" on newly initialized external back-end secrets. It affects Juju versions 3.0.0 through 3.6.18 (Go module github.com/juju/juju), and was published on March 18, 2026, with a patch released in version 3.6.19. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Juju Advisory).

The root cause is a time-of-check to time-of-use (TOCTOU) race condition classified as CWE-708 (Incorrect Ownership Assignment) in Juju's secrets management subsystem. A window of vulnerability exists between the moment a Juju Secret ID is generated and when the secret's first revision is actually created; during this interval, an attacker authenticated as a different unit agent can submit a claim for ownership of the known Secret ID. Because the system does not adequately validate that the claiming entity is the legitimate creator, the attacker's unit agent is assigned ownership, granting it read access to the initial secret revision's content. Exploitation requires network access and low-level privileges (valid unit agent credentials), but demands precise timing, resulting in high attack complexity (GitHub Advisory, Juju Advisory).

Successful exploitation results in unauthorized read access to the content of a newly created secret's initial revision, constituting a confidentiality breach with no impact on integrity or availability. Secrets managed by Juju may include sensitive credentials, API keys, or configuration data used by deployed applications, meaning exposure could facilitate further lateral movement or privilege escalation within the managed infrastructure. The attack is scoped to the affected Juju controller and does not directly affect resources outside the security boundary of the compromised secret (GitHub Advisory, Juju Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The high attack complexity requirement — necessitating precise timing and authenticated unit agent access — significantly limits opportunistic exploitation.

1. Obtain unit agent credentials: Gain authentication as a legitimate Juju unit agent within the target Juju deployment (e.g., through compromise of an existing charm or unit).
2. Monitor for Secret ID generation: Observe or predict when a new Juju Secret ID is being generated by another unit agent, either through log monitoring, network traffic analysis, or knowledge of application workflows that trigger secret creation.
3. Identify the Secret ID: Capture or infer the newly generated Secret ID before the first revision is committed to the secrets backend.
4. Race to claim ownership: During the window between Secret ID generation and first revision creation, submit an ownership claim for the identified Secret ID using the attacker's authenticated unit agent credentials.
5. Read secret content: Once ownership is claimed, use the attacker-controlled unit agent to read the content of the initial secret revision, exfiltrating sensitive data such as credentials or API keys (Juju Advisory).

• Logs: Juju controller audit logs showing a unit agent claiming ownership of a secret that was not created by that agent; unexpected ownership assignment events in secrets management logs shortly after Secret ID generation.
• Behavioral: A unit agent reading a secret revision it did not create, particularly the initial revision of a newly initialized secret; anomalous secret access patterns where a unit accesses secrets outside its expected application scope.
• Network: Unusual API calls to the Juju secrets management endpoint from unit agents not associated with the charm that initiated secret creation, particularly timed closely after secret ID generation events.

Canonical has released Juju version 3.6.19 which patches this vulnerability; all users running versions 3.0.0 through 3.6.18 should upgrade immediately (GitHub Advisory, Juju Advisory). No configuration-based workaround is documented; upgrading is the only confirmed remediation. As an interim measure, administrators should review audit logs for unauthorized secret access by unit agents, restrict unit agent credentials to the minimum necessary scope, and implement additional monitoring around secrets management operations.

The advisory was published by nikosgalanis on the Juju GitHub repository on March 18, 2026, with credit for discovery given to hpidcock (Juju Advisory). An openSUSE security announcement and a Linux Security advisory were subsequently published, indicating downstream distribution awareness (openSUSE Announce). No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking.