CVE-2026-67208
published 2026-07-30CVE-2026-67208: Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting…
PriorityP183critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
5.29%
92.0th percentile
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| somta | juggle | <= 1.6.0 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console u
ghsa_unreviewed·2026-07-30
CVE-2026-67208 [CRITICAL] CWE-306 Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console u
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
VulDB
somta Juggle up to 1.6.0 H2 Database Web Console Runtime.exec os command injection (EUVD-2026-51278)
vuldb·2026-07-30·CVSS 9.8
CVE-2026-67208 [CRITICAL] somta Juggle up to 1.6.0 H2 Database Web Console Runtime.exec os command injection (EUVD-2026-51278)
A vulnerability labeled as very critical has been found in somta Juggle up to 1.6.0. Affected by this vulnerability is the function Runtime.exec of the component H2 Database Web Console. The manipulation results in os command injection.
This vulnerability is reported as CVE-2026-67208. The attack can be launched remotely. No exploit exists.
No detection rules found.
Nuclei
Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console
nuclei·CVSS 9.8
CVE-2026-67208 [CRITICAL] Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console
Juggle Juggle")'
condition: and
internal: true
- method: GET
id: h2-console-check
path:
- "{{BaseURL}}/h2-console/"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- "H2 Console"
- "login.jsp?jsessionid="
condition: and
# digest: 490a004630440220191470cbbac630508b033fb08a1f3628a8e78df54e346df80520caad9ca76ea4022033c12926a02e80af5bf0e64bc740b4b2ff123e66ba5c7fa11e5c62ff4f37167c:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2026-07-30
Published