/Vulnerability Library

Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

CVE-2026-67208
Verified

Description

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials (sa/juggle) are known. An unauthenticated remote attacker can reach the console and, using the default credentials, achieve OS command execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Affected Product

juggle

Published Date

August 8, 2026

Template Author

str4k3r

CVE-2026-67208.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-67208
CWE ID:
cwe-306

References

https://github.com/somta/Juggle/issues/86https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console

Remediation Steps

Update to the latest version and change default credentials; restrict access to /h2-console.