CVE-2026-5774 — Race Condition in Juju

CWE-362 — Race Condition3 documents3 sources
Severity
6.0MEDIUMNVD
EPSS
0.0%
top 98.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Canonical JujuGithub.com Juju Juju
Timeline
PublishedApr 10

Description

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5canonical/juju2.0.0 — 2.9.57+2
▶Gogithub.com/juju_juju< 0.0.0-20260408003526-d395054dc2c3

🔴Vulnerability Details

2
GHSA
Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence↗2026-04-10
▶
CVEList
Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map↗2026-04-10
▶
CVE-2026-5774 — Race Condition in Canonical Juju | cvebase