PT-2026-31910 · Canonical · Juju

Published 2026-04-10 · Updated 2026-04-28 · CVE-2026-5774

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Canonical Juju versions 2.9.56, 3.6.20, and 4.0.5

Description Improper synchronization within the userTokens map in the API server of Canonical Juju may allow an authenticated user to cause a denial of service on the server or potentially reuse a single-use discharge token.

Recommendations Update to a version later than 4.0.5 Update to a version later than 3.6.20 Update to a version later than 2.9.56

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-5774

GHSA-7M55-2HR4-PW78

Affected Products

Juju

References · 10

• 🔥 https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78 · Exploit
• https://github.com/juju/juju/pull/22206 · Patch
• https://github.com/juju/juju/pull/22205 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5774 · Security Note
• https://osv.dev/vulnerability/GHSA-7m55-2hr4-pw78 · Vendor Advisory
• https://github.com/juju/juju · Note
• https://twitter.com/infoflowcloud/status/2042593650899562524 · Twitter Post
• https://twitter.com/_cvereports/status/2049068807063224744 · Twitter Post
• https://twitter.com/CVEnew/status/2042593148388675822 · Twitter Post
• https://twitter.com/CVEarity/status/2043253535178166343 · Twitter Post