Juju EUVD-2026-21366

The CVSS vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H) indicates this is a network-accessible vulnerability requiring low privilege authentication and high attack complexity with partial attacker timing control, resulting in complete availability impact but no confidentiality or integrity loss. The EPSS score of 6.1 suggests moderate exploitation likelihood in the wild. Critically, this vulnerability requires authenticated access (PR:L), which narrows the threat actor pool to users with valid credentials, reducing real-world risk compared to unauthenticated vulnerabilities. The partial timing requirement (AT:P) makes reliable exploitation difficult in practice. However, the availability impact is severe-a successful attack disables the API server for all users. The race condition nature means automated scanning cannot detect vulnerability presence, only version inventory. For environments where Juju API server stability is critical and where authentication credentials are loosely controlled, this poses moderate-to-high priority. For restricted environments with strong authentication, priority is lower.

An authenticated user with low-privilege access to a Juju environment crafts multiple concurrent requests to the API server targeting token validation endpoints. By timing the requests to hit a narrow race condition window in the userTokens map synchronization, the attacker either causes the API server to crash or become unresponsive (DoS), or successfully reuses a discharge token that should have been single-use, bypassing authentication controls for subsequent operations. No public proof-of-concept code has been identified, but the race condition is reliable enough that exploitation is feasible for attackers with knowledge of Juju's internals.