CVE-2026-5774: Canonical Juju race condition in API server userTokens map

Executive brief

A race condition in the Canonical Juju API server's token management allows authenticated users to cause a denial of service or reuse single-use discharge tokens.

Affected products

• Go github.com/juju/juju

References

• https://api.github.com/users/fg0x0
• https://github.com/fg0x0
• https://api.github.com/users/fg0x0/gists%7B/gist_id%7D
• https://api.github.com/users/fg0x0/repos
• https://avatars.githubusercontent.com/u/35772301?v=4
• https://api.github.com/users/fg0x0/events%7B/privacy%7D