CVE-2026-67208

Deferred Deferred - Pending Action

Remote Code Execution in Juggle through 1.6.0

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VulnCheck

Description

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67208

EUVD

EUVD-2026-51278

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Juggle through 1.6.0 has a remote code execution flaw. Unauthenticated attackers can connect to the exposed H2 database web console using default credentials. They access the /h2-console endpoint, log in with default credentials, and use the H2 CREATE ALIAS Runtime.exec() method to run arbitrary OS commands. This leads to root-level code execution when the stock Docker image is used.

Detection Guidance

Check if the /h2-console endpoint is exposed on your network by scanning for open ports 8082 or 8081. Use curl to access the endpoint: curl http://<target-ip>:8082/h2-console. If the H2 database web console is accessible without authentication, the system is vulnerable.

Impact Analysis

An attacker could take full control of the affected system, install malware, steal data, or disrupt services. If running in a containerized environment like Docker, the attack could compromise the host system due to root-level execution.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health information privacy). Organizations may face fines, legal action, and reputational damage if sensitive data is exposed due to this flaw.

Mitigation Strategies

Disable the H2 database web console by removing or restricting access to the /h2-console endpoint. Update Juggle to a patched version if available. Ensure no default credentials are used and implement network-level access controls to block unauthorized access.

Hi! I’m here to help you understand CVE-2026-67208. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70