Description
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| somta | Juggle | — | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console http/cves/2026/CVE-2026-67208.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- Researcher Disclosure technical-description issue-tracking
- https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console third-party-advisory