CVE-2026-5774

MediumCVSS 6.4

Published: 10/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

Canonical Juju 4.0.5, 3.6.20, and 2.9.56 have improper synchronization of the userTokens map in the API server. This may allow an authenticated user to cause a denial of service or reuse a single-use discharge token.

Risk Assessment

An authenticated attacker could disrupt the Juju server or bypass the single-use token mechanism, potentially leading to unauthorized actions.

Recommendation

Update Canonical Juju to a version containing the fix (4.0.5, 3.6.20, 2.9.56 or later, as per vendor guidance).

Other vulnerabilities in Canonical Juju

CVE-2026-93336High
Canonical Juju versions 4.0 through 4.0.15 lack authorization in the unit resources download route. A controller-authenticated principal (a unit agent or a user with only login permission) can read any application's charm resources in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.

Original NVD description (English source)

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS