Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting …

Juggle through version 1.6.0 contains a critical remote code execution vulnerability tracked as CVE-2026-67208. The vulnerability allows unauthenticated remote attackers to execute arbitrary OS commands by accessing an unprotected /h2-console endpoint. Attackers authenticate using default shipped credentials and exploit the H2 CREATE ALIAS Runtime.exec() technique to run arbitrary commands. When running the stock Docker image, exploitation results in root-level code execution. No authentication bypass is required as the endpoint is entirely unprotected. The vulnerability is especially dangerous in containerized deployments using default configurations. Remediation requires disabling or securing the H2 console endpoint and changing default credentials.