Vulnerability in Juicedata Juicefs
CVE-2026-59092
JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.007 · change: +0.003
Affected products
- Juicedata Juicefs — versions 0, a46979cdd4082217081ee99b931ddc53d038e47a
Weakness classification (CWE)
References
- github.com/juicedata/juicefs/commit/a46979cdd4082217081ee99b931ddc53d038e47a (Patch, patch)
- github.com/juicedata/juicefs/issues/7213 (technical-description, Vendor Advisory)
- github.com/juicedata/juicefs/pull/7214 (issue-tracking, Issue Tracking)
- www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-and-metric… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-59092?
- CVE-2026-59092 is a high-severity vulnerability in Juicedata Juicefs, classified under Active Debug Code. CVSS score: 7.7/10. Published 2026-07-02.
- How severe is CVE-2026-59092?
- High severity. CVSS v3 base score is 7.7 out of 10.