CVE-2026-5774

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5774
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5774.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5774
Aliases
Downstream
Related
Published
2026-04-10T12:10:55.634Z
Modified
2026-08-04T11:31:13.025219206Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map
Details

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Database specific 
{
    "cwe_ids": [
        "CWE-362"
    ],
    "cna_assigner": "canonical",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5774.json"
}
References

Affected packages

Git / github.com/juju/juju

Affected ranges

Type
GIT
Repo
https://github.com/juju/juju
Events
Introduced
6cf1bc9d917a4c56d0034fd6e0d6f394d6eddb6e
Fixed
50bd2ae2c22c5de86aef5b678cd75228107165f6
Introduced
35c560704ee254219ae0c4a37810bde5278e99bb
Fixed
d395054dc2c360690239f2aedc6fd3ae9b46e279
Introduced
766e8bca985b3f7c350666d36106389bc38b7af2
Fixed
a6e34d9dedebd0759de82efd49b8dff24c945233
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.9.57"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.6.21"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.6"
        }
    ]
}

Affected versions

Other
delete-ecs
juju-
juju-2.*
juju-2.0.0
juju-2.1-beta1
juju-2.1-beta2
juju-2.2-alpha1
juju-2.2-beta1
juju-2.2-beta2
juju-2.2-beta3
juju-2.2-beta4
juju-2.2-rc1
juju-2.3-beta1
juju-2.3-beta2
juju-2.3-beta3
juju-2.3-rc1
juju-2.3-rc2
juju-2.4-beta1
juju-2.4-beta2
juju-2.4-beta3
juju-2.4-rc1
juju-2.5-beta1
juju-2.5-beta2
juju-2.5-beta3
juju-2.6-beta1
juju-2.6-beta2
juju-2.6-rc1
juju-2.7-beta1
juju-2.7-rc1
juju-2.8-beta1
juju-2.8-rc1
juju-2.9-beta1
juju-2.9-rc1
juju-2.9-rc10
juju-2.9-rc11
juju-2.9-rc12
juju-2.9-rc2
juju-2.9-rc3
juju-2.9-rc4
juju-2.9-rc5
juju-2.9-rc6
juju-2.9-rc7
juju-2.9-rc8
juju-2.9-rc9
juju-2.9.0
juju-2.9.1
juju-2.9.10
juju-2.9.11
juju-2.9.12
juju-2.9.13
juju-2.9.14
juju-2.9.15
juju-2.9.16
juju-2.9.17
juju-2.9.18
juju-2.9.19
juju-2.9.2
juju-2.9.20
juju-2.9.21
juju-2.9.22
juju-2.9.23
juju-2.9.24
juju-2.9.25
juju-2.9.26
juju-2.9.27
juju-2.9.28
juju-2.9.29
juju-2.9.3
juju-2.9.30
juju-2.9.31
juju-2.9.32
juju-2.9.33
juju-2.9.34
juju-2.9.35
juju-2.9.36
juju-2.9.37
juju-2.9.38
juju-2.9.39
juju-2.9.4
juju-2.9.40
juju-2.9.41
juju-2.9.42
juju-2.9.43
juju-2.9.44
juju-2.9.45
juju-2.9.46
juju-2.9.5
juju-2.9.6
juju-2.9.7
juju-2.9.8
juju-2.9.9
juju-3.*
juju-3.0-beta1
juju-3.0-beta2
juju-3.0-beta3
juju-3.0-beta4
juju-3.0-rc1
juju-3.1.6
juju-3.2-beta1
juju-3.2.3
juju-3.2.4
juju-3.3-beta1
juju-3.3.0
v2.*
v2.9.45
v2.9.46
v2.9.47
v2.9.48
v2.9.49
v2.9.53
v3.*
v3.3-beta2
v3.3-rc1
v3.3-rc2
v3.3.0
v3.4-beta1
v3.4-rc1
v3.5-beta1
v3.6-beta1
v3.6-beta2
v3.6-rc1
v3.6-rc2
v3.6.1
v3.6.10
v3.6.11
v3.6.12
v3.6.13
v3.6.14
v3.6.15
v3.6.16
v3.6.17
v3.6.18
v3.6.19
v3.6.2
v3.6.20
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.6.9
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5774.json"