Remote Code Execution in Juggle via Exposed H2 Database Console

CVE-2026-67208

What is CVE-2026-67208?

The Juggle product version 1.6.0 has a vulnerability that exposes the H2 database web console, allowing unauthenticated attackers to gain access through default credentials. By exploiting the unprotected /h2-console endpoint, attackers can utilize the CREATE ALIAS Runtime.exec() feature to execute arbitrary operating system commands. This can lead to unauthorized root-level code execution, especially when the Juggle application is deployed using its default Docker image configuration, potentially compromising the integrity and security of the host system.

References