CVE-2026-67208

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67208

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67208.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67208

Published

2026-07-30T19:17:42.126Z

Modified

2026-07-31T11:30:38.307658908Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Details

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.

Database specific

{
    "cwe_ids": [
        "CWE-1188",
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67208.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/somta/juggle

Affected ranges

Type

GIT

Repo

https://github.com/somta/juggle

Events

Introduced

Last affected

6a6ce5a90ffe1459a4d43e38141a184739099770

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.6.0"
        }
    ]
}

Affected versions

1.*

1.1.0

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.3.1

v1.*

v1.0.0

v1.3.2

v1.4.0

v1.5.0

v1.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67208.json"