{"id":"EUVD-2026-21366","enisaUuid":"f564646c-7b13-3f24-90b4-91f6d9ae219a","description":"Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.","datePublished":"Apr 10, 2026, 12:10:55 PM","dateUpdated":"Apr 10, 2026, 12:41:28 PM","baseScore":6.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78\nhttps://github.com/juju/juju/pull/22206\nhttps://github.com/juju/juju/pull/22205\n","aliases":"CVE-2026-5774\n","assigner":"canonical","epss":0.24,"enisaIdProduct":[{"id":"66ae66a1-bd55-352e-98b4-93033a48a671","product":{"name":"Juju","vendor":{"name":"Canonical"}},"product_version":"4.0.0 \u003c4.0.6"},{"id":"711b8528-53e0-3ce5-b885-1ef3e848585a","product":{"name":"Juju","vendor":{"name":"Canonical"}},"product_version":"3.0.0 \u003c3.6.21"},{"id":"7514e065-8863-3a37-9375-30f65472db3b","product":{"name":"Juju","vendor":{"name":"Canonical"}},"product_version":"2.0.0 \u003c2.9.57"}],"enisaIdVendor":[{"id":"071444e9-7939-3ecb-94b9-35793e9a5148","vendor":{"name":"Canonical"}}],"enisaIdVulnerability":[{"id":"0e5c938f-09a3-3c57-b877-09fc91ac470b","vulnerability":{"id":"GHSA-7m55-2hr4-pw78","description":"Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence","datePublished":"Apr 10, 2026, 9:00:35 PM","dateUpdated":"Apr 27, 2026, 4:21:10 PM","baseScore":0.0,"references":"https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5774\nhttps://github.com/juju/juju/pull/22205\nhttps://github.com/juju/juju/pull/22206\nhttps://github.com/juju/juju\n","enisa_id":"EUVD-2026-21366\n","aliases":"CVE-2026-5774\nGHSA-7m55-2hr4-pw78\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"901a1fd4-b298-32b3-a653-089fd08ddefc","vulnerability":{"id":"CVE-2026-5774","description":"Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.","datePublished":"Apr 10, 2026, 12:10:55 PM","dateUpdated":"Apr 10, 2026, 12:41:28 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/juju/juju/security/advisories/GHSA-7m55-2hr4-pw78\nhttps://github.com/juju/juju/pull/22206\nhttps://github.com/juju/juju/pull/22205\n","enisa_id":"EUVD-2026-21366\n","assigner":"canonical","epss":0.24,"dataProcessed":"Oct 28, 2026, 7:16:39 AM","vulnerabilityProduct":[{"id":"46f96b4e-8dc3-3a07-9e69-f656f80c4f4c","product":{"name":"Juju","vendor":{"name":"Canonical"}},"product_version":"2.0.0 \u003c2.9.57"},{"id":"8f5dd38c-2b94-3f2e-b87b-a8c85cd2cdb1","product":{"name":"Juju","vendor":{"name":"Canonical"}},"product_version":"4.0.0 \u003c4.0.6"},{"id":"fdfa1217-eb9c-3127-ac2e-fd2b9ba8bfef","product":{"name":"Juju","vendor":{"name":"Canonical"}},"product_version":"3.0.0 \u003c3.6.21"}],"vulnerabilityVendor":[{"id":"3e47f84e-078d-3320-9980-bac2b6e32c39","vendor":{"name":"Canonical"}}]}}],"enisaIdAdvisory":[]}