CVE-2026-59092

Name of the Vulnerable Software and Affected Versions JuiceFS versions prior to 1.3.2

Description An authentication bypass exists due to improper handler registration on the shared http.DefaultServeMux. This allows unauthenticated remote attackers to access sensitive debug and metrics endpoints. Specifically, requesting the '/debug/pprof/cmdline' endpoint can expose the process command line, which may contain metadata engine connection strings and database credentials, potentially granting full read/write access to filesystem metadata. Additionally, other pprof handlers may leak internal state, and profiling handlers can be used to cause a denial of service.

Recommendations Update JuiceFS to version 1.3.2 or later to apply the fix implemented in commit a46979c.