PT-2026-31910 · Canonical · Juju

CVE-2026-5774 · Published 2026-04-10 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Canonical Juju versions 2.9.56, 3.6.20, and 4.0.5

Description Improper synchronization within the userTokens map in the API server of Canonical Juju may allow an authenticated user to cause a denial of service on the server or potentially reuse a single-use discharge token.

Recommendations Update to a version later than 4.0.5 Update to a version later than 3.6.20 Update to a version later than 2.9.56

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-5774

GHSA-7M55-2HR4-PW78

GO-2026-5228

OPENSUSE-SU-2026:21483-1

Affected Products

Juju

References · 1749

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5774.json · Exploit
• 🔥 https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78 · Exploit
• https://github.com/juju/juju/pull/22205 · Patch
• https://github.com/juju/juju/pull/22206 · Patch
• https://osv.dev/vulnerability/GHSA-7m55-2hr4-pw78 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5774 · Security Note
• https://osv.dev/vulnerability/CVE-2026-5774 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5228 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/juju/juju · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note