JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive…

JuiceFS versions through 1.3.1 contain an authentication bypass vulnerability (CVE-2026-59092) fixed in commit a46979c. The flaw stems from improper handler registration on the shared http.DefaultServeMux, allowing unauthenticated remote attackers to access sensitive debug and metrics endpoints. Attackers can exploit the /debug/pprof/cmdline endpoint to retrieve the process command line, which may contain metadata engine connection strings with database credentials. This grants full read/write access to filesystem metadata. Additional pprof handlers expose internal state information, and profiling handlers can be abused to cause denial of service. The vulnerability poses a significant risk to deployments exposing these endpoints to untrusted networks.