CVE-2026-67208

Name of the Vulnerable Software and Affected Versions Juggle versions prior to 1.6.0

Description Unauthenticated remote attackers can execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected '/h2-console' endpoint and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute commands, which results in root-level code execution when using the stock Docker image.

Recommendations Update to version 1.6.0 or later. Restrict access to the '/h2-console' endpoint. Change the default shipped credentials for the H2 database web console.