Juju API 服务器由于未同步的 Token Map 导致拒绝服务和身份验证重放

CVE-2026-5774 影响 Juju API 服务器，特别是 localLoginHandlers 结构体。该结构体使用内存映射来存储成功的本地身份验证后的放电令牌。该漏洞在于该映射没有同步原语（例如互斥锁）的保护，就被多个 HTTP 处理程序 goroutine 并发访问。这可能导致 Go 运行时恐慌，因为在读取、写入或删除令牌时会发生竞争条件。在最坏的情况下，放电令牌可能在删除之前被多次消耗，从而可能允许对 Juju 环境中的资源或操作进行未经授权的访问。

Organizations heavily reliant on Juju for application deployment and management are at significant risk. This includes cloud providers, DevOps teams, and any environment where Juju is used to orchestrate applications, especially those handling sensitive data or critical infrastructure. Environments with legacy Juju installations or those that have not implemented robust access controls are particularly vulnerable.

• linux / server: Monitor Juju API server logs for Go runtime panics or unusual authentication patterns. Use journalctl -u juju-api-server to filter for error messages related to discharge token handling.

journalctl -u juju-api-server | grep -i "panic"

• go: Review Juju source code for potential concurrency issues in the localLoginHandlers struct and related functions. Use static analysis tools to identify potential race conditions. • generic web: Monitor authentication endpoints for unusual request patterns or excessive authentication attempts. Check access logs for errors related to discharge token handling.

1. 2026-04-10Disclosure

   disclosure

1. 已保留2026-04-08
2. 发布日期2026-04-10
3. 修改日期2026-04-12
4. EPSS 更新日期2026-04-18

提供的修复程序 (0.0.0-20260408003526-d395054dc2c3) 通过引入适当的同步机制（例如互斥锁）来保护对放电令牌映射的并发访问，从而解决了此漏洞。强烈建议尽快升级到此修复版本。此外，请查看您的 Juju 环境的安全策略，并将对资源的访问限制为授权用户和服务。监控 Juju API 服务器日志以查找错误或异常行为也可以帮助检测潜在的利用尝试。考虑实施多因素身份验证 (MFA) 以获得额外的安全层。