BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-67208Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.

9.3 CRITICALEPSS 7.22%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.3CRITICAL4.0VulnCheck (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.8CRITICAL3.1VulnCheck (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CVE ID
CVE-2026-67208
Status
Deferred
Assigner (CNA)
VulnCheck
Published
Jul 30, 2026
Last modified
2026-10-23 22:10 UTC
Weaknesses
  • CWE-306 · Missing Authentication for Critical Function
  • CWE-1188 · Initialization of a Resource with an Insecure Default

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 09:25 UTC.