CVE-2026-67208 is a critical (CVSS 9.8) flaw in Juggle through 1.6.0. The H2 database web console ships enabled, reachable from other hosts, with default credentials, which allows remote command execution. I found no fixed version, so disable the console and change the credentials now.
What's affected
- Product: Juggle, an open source API orchestration project (somta/Juggle).
- Affected versions: through 1.6.0, and the develop branch at the time of the report.
- Fixed version: none found. The GitHub issue was still open when I read it. Check the project for a newer release.
- Weaknesses: CWE-306 missing authentication for critical function and CWE-1188 insecure default initialization of a resource.
- Severity: CVSS 3.1 9.8. The VulnCheck advisory scores it 9.3 under CVSS 4.0. The stock Docker image runs as root, according to the report.
- Cause: per the report, the console is enabled, allowed to accept connections from other hosts, and the shipped datasource uses default credentials.
How to check if you're exposed
Check the configuration of every Juggle deployment for the console settings named in the report:
grep -r -E 'h2.console' application*.properties
Look for h2.console enabled set to true and web-allow-others set to true. In a container, check the image and the mounted configuration. Then test from another machine whether the console path responds on the application port. If it answers, treat the host as exposed.
Also check whether the shipped datasource user and password were changed. Default values are published in the report.
What to do now
- Find every Juggle deployment, including Docker Compose stacks.
- Disable the H2 console in production, or set web-allow-others to false, as the report recommends.
- Change the datasource credentials from the shipped defaults.
- Do not publish the application port directly. Put it behind a reverse proxy with authentication, or restrict by network.
- Run the container as a non root user and review the host for signs of compromise if it was exposed.
- Watch the project for a release that changes these defaults.
Why it matters
This is an insecure default, not a coding slip in a complex feature. A developer convenience, the H2 web console, was left on and open to the network, and the credentials that protect it were the same for every install. The authentication layer in the application did not cover that path.
Default credentials with network exposure are a recurring cause of serious compromises because they need no skill to abuse. The record gives no exploitation reports and the CISA KEV flag is false. Anyone deploying open source tools from a sample compose file should review these settings before the first start.
Try it yourself
Insecure defaults often live inside images. This walkthrough shows a container image scan and what it reports.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
I did not find one. The mitigation in the report is a configuration change, which you can apply today.
Why does the container matter?
The report says the stock image runs as root, so command execution there would have full rights inside the container.
Sources
Last reviewed: 19 October 2026.
