Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

criticalseverity

9.8CVSS score

7.2%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials (sa/juggle) are known. An unauthenticated remote attacker can reach the console and, using the default credentials, achieve OS command execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.

Impact

Unauthenticated remote attackers can execute arbitrary OS commands with root privileges, leading to full system compromise.

Fix

Update to the latest version and change default credentials; restrict access to /h2-console.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 200 and contains(body, "<title>Juggle</title>")
Send: GET {{BaseURL}}/h2-console/
Positive when: status 200 AND contains "<title>H2 Console</title>" and "login.jsp?jsessionid="

Run it with nuclei: nuclei -id CVE-2026-67208 -u <target>

The full check

id: CVE-2026-67208

info:
  name: Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console
  author: str4k3r
  severity: critical
  description: |
    Juggle ships the H2 database web console enabled and reachable from
    non-localhost by default. No application-level authentication covers
    the /h2-console path, and the shipped default datasource credentials
    (sa/juggle) are known. An unauthenticated remote attacker can reach the
    console and, using the default credentials, achieve OS command
    execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.
  impact: |
    Unauthenticated remote attackers can execute arbitrary OS commands with root privileges, leading to full system compromise.
  remediation: |
    Update to the latest version and change default credentials; restrict access to /h2-console.
  reference:
    - https://github.com/somta/Juggle/issues/86
    - https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-67208
    epss-score: 0.07223
    epss-percentile: 0.94372
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    product: juggle
    vendor: somta
  tags: cve,cve2026,juggle,h2,exposure,unauth,rce

flow: |
  http("juggle-detect") && http("h2-console-check")

http:
  - method: GET
    id: juggle-detect
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>Juggle</title>")'
        condition: and
        internal: true

  - method: GET
    id: h2-console-check
    path:
      - "{{BaseURL}}/h2-console/"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "<title>H2 Console</title>"
          - "login.jsp?jsessionid="
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from