CVE-2026-67208 Scanner
CVE-2026-67208 Scanner - Remote Code Execution (RCE) vulnerability in Juggle
Used 3.3k times · 5.9k assets checked · url
CVE
CVE-2026-67208
9.3
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
juggle
Updated Sep 26, 2026View on NVD →
S4E scanner
CVE history: juggle
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →