CVE-2026-59092 Details

An authentication bypass vulnerability has been identified in JuiceFS versions through 1.3.1. This vulnerability allows unauthenticated remote attackers to access sensitive debug and metrics endpoints. The issue arises from improper handler registration on the shared http.DefaultServeMux, which exposes these endpoints without authentication. Attackers can exploit this to access the /debug/pprof/cmdline endpoint, which reveals the process command line including metadata engine connection strings with database credentials. This access could lead to unauthorized read/write operations on filesystem metadata. Additionally, other pprof handlers could disclose internal state and profiling information, potentially causing a denial-of-service condition.

Users can update to JuiceFS version 1.3.1 or later, where this vulnerability has been fixed. Instructions for updating can be found in the JuiceFS documentation.