CVE-2026-5774: Canonical Juju

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

Affected products

• Canonical Juju: before 2.9.57 (fixed in 2.9.57); from 3.0, before 3.6.21 (fixed in 3.6.21); from 4.0, before 4.0.6 (fixed in 4.0.6)

Published 2026-04-10. Last modified 2026-06-17.