CVE-2026-67208: Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

2026-08-16 Juggle PoC Public

Description

Juggle ships the H2 database web console enabled and reachable from

non-localhost by default. No application-level authentication covers

the /h2-console path, and the shipped default datasource credentials

(sa/juggle) are known. An unauthenticated remote attacker can reach the

console and, using the default credentials, achieve OS command

execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.

PoC

id: CVE-2026-67208

info:
  name: Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console
  author: str4k3r
  severity: critical
  description: |
    Juggle ships the H2 database web console enabled and reachable from
    non-localhost by default. No application-level authentication covers
    the /h2-console path, and the shipped default datasource credentials
    (sa/juggle) are known. An unauthenticated remote attacker can reach the
    console and, using the default credentials, achieve OS command
    execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.
  impact: |
    Unauthenticated remote attackers can execute arbitrary OS commands with root privileges, leading to full system compromise.
  remediation: |
    Update to the latest version and change default credentials; restrict access to /h2-console.
  reference:
    - https://github.com/somta/Juggle/issues/86
    - https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-67208
    epss-score: 0.05285
    epss-percentile: 0.92155
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    product: juggle
    vendor: somta
  tags: cve,cve2026,juggle,h2,exposure,unauth,rce

flow: |
  http("juggle-detect") && http("h2-console-check")

http:
  - method: GET
    id: juggle-detect
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>Juggle</title>")'
        condition: and
        internal: true

  - method: GET
    id: h2-console-check
    path:
      - "{{BaseURL}}/h2-console/"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "<title>H2 Console</title>"
          - "login.jsp?jsessionid="
        condition: and
# digest: 490a004630440220415f099749a26f778611e2f2f4ce227cf1ffc9b8aed77721a418715293154e7d022058f61a06344865aa6d317b370954fd3baf0ef92d03c54eaabd6f502d5ef1b3e0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-67208.yaml

References

Related Vulnerabilities