CVE-2026-59092 is a high severity flaw (CVSS 7.7) in JuiceFS through 1.3.1. Debug and metrics endpoints were registered on a shared HTTP handler with no authentication, and one of them can reveal metadata engine credentials. The fix is in commit a46979c.
What's affected
- JuiceFS through 1.3.1.
- Fixed in commit a46979c (pull request 7214). A numbered release containing it is not confirmed in the record, so check the project.
- The linked issue describes the JuiceFS WebDAV server exposing these endpoints on its public listen address.
How to check if you're exposed
Run juicefs version and compare against the fix. Then check from another host whether the debug path /debug/pprof/ answers on your WebDAV or gateway port. Use only systems you own for that test.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade to a JuiceFS build that includes commit a46979c.
- Treat the metadata engine credentials as exposed if the endpoint was reachable. Rotate the database password.
- Restrict the WebDAV listen address with a firewall or bind it to a private interface.
- Do not put credentials in the process command line where you can avoid it.
- Review database logs for logins from unexpected hosts.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
The record classes this as CWE-489 (Active Debug Code), active debug code left in production. The issue explains the cause: handlers registered on the shared default HTTP multiplexer in Go are served by any listener that uses it, so the WebDAV server inherited the pprof and metrics routes. The fix gives the metrics server its own dedicated multiplexer.
The issue lists three kinds of harm. The command line endpoint can return the full process command line, which on a typical deployment holds the metadata engine URL, and so credentials. Other pprof endpoints disclose mount points, cache paths and internal layout. The profiling endpoints can hold CPU for long periods, which allows denial of service. It also says the metrics were meant to bind only to a local address.
This class of bug is easy to miss, because importing a package for a side effect can register routes without any visible code. The CISA KEV flag is false.
If you run JuiceFS in production, the exposure to look for is any listener that serves HTTP, since the shared handler registration affects all of them. Gateways and WebDAV servers are the likely candidates, per the issue.
Quick check
What is the biggest risk?
Credential disclosure. With the metadata database URL an outsider could gain read and write access to filesystem metadata, per the issue.
Does rotating credentials matter after patching?
Yes, if the endpoint was reachable, because the patch cannot undo an earlier leak.
Sources
Last reviewed: 19 October 2026.
