CVE-2026-67208 Details
Description
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
A remote code execution vulnerability exists in Juggle versions through 1.6.0. The issue arises because the H2 database web console is enabled by default, accessible from non-localhost, and lacks application-level authentication. Unauthenticated remote attackers can exploit this by using the default 'sa' user and 'juggle' password to access the console. Once logged in, attackers can utilize the H2 'CREATE ALIAS Runtime.exec()' feature to execute arbitrary operating system commands. This exploitation leads to root-level code execution when the stock Docker image is used.
Disable the H2 console in production environments or restrict it to localhost and secure it with authentication. Also, avoid using default 'sa' and 'juggle' datasource credentials.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 30, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/somta/Juggle/issues/86 | CISA-ADP | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://github.com/somta/Juggle/issues/86 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| somta Juggle | <= 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | New CVE Received | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |