The vulnerability is a race condition in Juju's secrets subsystem present in versions 3.0.0 to 3.6.18. During the period between secret ID generation and creation of the first revision, an attacker with unit agent credentials can claim ownership of a known secret. After claiming ownership, the attacker can read the contents of that secret's first revision. This is a confidentiality breach classified under CWE‑708.

Canonically Juju deployments running any version between 3.0.0 and 3.6.18 inclusive. The vulnerability is limited to authenticated unit agents within a Juju cluster.

The CVSS score is 5.3, indicating moderate severity. EPSS is less than 1%, implying a low probability of exploitation in the wild. The vulnerability is not listed in KEV. The attack vector requires local authenticated access to a unit agent; an attacker who can execute code as a unit agent can exploit the race condition by timing the claim before the secret first revision is created.