A vulnerability in Juju versions 3.0.0 through 3.6.18 allows a grantee that has permission to request secrets to leverage a predictable secret identifier (XID) and infer secrets that have been granted to other grantees by the same owner. This flaw is an instance of Improper Assertion of Permissions (CWE‑343) and Information Exposure Through Collection of Account Information (CWE‑639). The attacker can then use those inferred secrets to access resources and configurations that should be restricted, potentially leading to unauthorized configuration changes or data exposure.

Canonical Juju 3.0.0 through 3.6.18 are affected. No other vendors or product versions are listed as impacted in the CNA data.

The CVSS score of 6.6 indicates moderate severity, while an EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker be a grantee with permission to request secrets, that a system administrator has deployed at least two separate applications (one under attacker control), and that the attacker can generate or request secrets using the predictable XID pattern. Therefore the attack vector is constrained but still poses a tangible risk of unauthorized secret access.