CVE-2026-67208
Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jul 30, 2026
- Updated
- Jul 31, 2026
- Reserved
- Jul 28, 2026
Description
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Jugglesomta |
|
References
- Researcher Disclosuretechnical-descriptionissue-tracking
- https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-consolethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.