CVE-2026-5774

MediumCVSS 6.4/10Last modified Oct 26, 2026

Description

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Canonical	Juju	>= 2.0.0, < 2.9.57; >= 3.0.0, < 3.6.21; >= 4.0.0, < 4.0.6

References

https://github.com/juju/juju/pull/22205Issue Tracking
https://github.com/juju/juju/pull/22206Issue Tracking
https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78Exploit, Third Party Advisory
https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78Exploit, Third Party Advisory

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-577407.1Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Config CVE-2026-577417.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing CVE-2026-577427.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Refl CVE-2026-577438.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 CVE-2026-577449.8Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affect CVE-2026-577457.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e CVE-2026-577467.1Subscriber Broken Access Control in Booked <= 3.0.0 versions.CVE-2026-577476.5Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.CVE-2026-577487.5Contributor Local File Inclusion in Shopify <= 1.0.0 versions.CVE-2026-577497.5Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.CVE-2026-577505.3Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.CVE-2026-577518.1Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.