CVE-2026-67208
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default credentials.
Risk Assessment
Attackers can access the H2 console, authenticate with default credentials, and use the CREATE ALIAS Runtime.exec() technique to execute arbitrary commands with root privileges in the default Docker image.
Recommendation
Change default H2 database credentials, block access to the H2 console, or update to a patched version.
Original NVD description (English source)
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.