RCE in Somta Juggle
CVE-2026-67208
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.
Vulnerability class: Broken Authentication
EPSS: 0.053 (92.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Somta Juggle — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking, technical-description)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-67208?
- CVE-2026-67208 is a critical-severity vulnerability in Somta Juggle, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-07-30.
- How severe is CVE-2026-67208?
- Critical severity. CVSS v3 base score is 9.8 out of 10.