CVE-2026-5774

OVERVIEW CVE-2026-5774 is an improper synchronization vulnerability affecting the userTokens map in the API server of Canonical Juju versions 4.0.5, 3.6.20, and 2.9.56. An authenticated user can exploit this flaw to either deny service to the server or reuse single-use discharge tokens, potentially gaining unauthorized access. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.4 (MEDIUM) with a network-based attack vector requiring low privileges and high attack complexity. The impact is significant, with potential consequences including service disruption (high availability impact), information disclosure (low confidentiality impact), and token manipulation (low integrity impact). The FAUCET Risk Score of 44.0 out of 100 indicates moderate risk. EXPLOITATION STATUS There is no current evidence of active exploitation. The CVE is not listed on the Known Exploited Vulnerabilities catalog, and the EPSS score of 0.00011 suggests negligible probability of exploitation in the wild relative to other CVEs. The vulnerability remains inactive on threat tracking lists, indicating limited community attention and no publicly available exploit code at this time.