GHSA-5CJ2-RQQF-HX9P Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets

Summary Predictable secret ID and lack of secret origin API enable confused deputy attacks on Juju workloads. Details A Juju application can create a secret and grant it to another integrated application grantee. When they do so, the secret owner has to communicate the secret id to the grantee. T...

PT-2026-26059

Name of the Vulnerable Software and Affected Versions Juju versions 3.0.0 through 3.6.18 Description Juju versions 3.0.0 through 3.6.18 are susceptible to a confused deputy issue stemming from predictable secret IDs XIDs. When a secret owner grants permissions to a secret to a grantee, the owner...