PT-2026-66572 · Somta · Juggle

Fatullayev Asadbek · CVE-2026-67208 · Publicado 2026-07-30 · Atualizado 2026-07-30

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

CWE-1188

Identificadores relacionados

CVE-2026-67208

Produtos afetados

Juggle

Referências · 3

• 🔥 https://github.com/somta/Juggle/issues/86 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-67208 · Nota de Segurança
• https://vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console · Nota