CVE-2026-5774CWE-362

Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map

Medium · published April 10, 2026

CVSS v4.0
6.1
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

The record
Technical detail
CVSS v4.0
6.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-04-10T12:10Z
EPSS history
Timeline
  • 10 APR 12:10Z
    Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map
    cvelistv5