CVE-2026-67208 PoC — Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-67208.yaml

Associated Vulnerability

Title: Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console (CVE-2026-67208)
Description:Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.

Description

Juggle ships the H2 database web console enabled and reachable from
non-localhost by default. No application-level authentication covers
the /h2-console path, and the shipped default datasource credentials
(sa/juggle) are known. An unauthenticated remote attacker can reach the
console and, using the default credentials, achieve OS command
execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →