CVE-2026-5774: Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-10 · updated 2026-10-26
Weakness: CWE-362

Description

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Affected products

Canonical Juju: before 2.9.57; from 3.0 before 3.6.21; from 4.0 before 4.0.6 — fixed in 2.9.57, 3.6.21, 4.0.6

How to fix

Upgrade to a fixed version: Canonical Juju 2.9.57, 3.6.21, 4.0.6. Check the vendor advisory for mitigations.

References

https://github.com/juju/juju/pull/22205
https://github.com/juju/juju/pull/22206
https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78
https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78

Get alerted when CVE-2026-5774 or the next vulnerability affects your stack