Executive brief
JuiceFS, an open-source cloud-native file system, contains a security flaw that unintentionally exposes sensitive internal diagnostic and performance data to the network without requiring a password. An attacker can exploit this to view the system's configuration, which may include database passwords and connection strings, potentially granting them full control over the file system's data. Additionally, an attacker could use these exposed diagnostic tools to overwhelm the system, causing a service outage.
Technical details
JuiceFS through version 1.3.1 is vulnerable to an authentication bypass affecting its WebDAV, Prometheus metrics, and sync manager components. The vulnerability stems from the use of Go's 'http.DefaultServeMux' (via passing nil to http.ListenAndServe), which causes the application to unintentionally expose handlers registered by side-effect imports like 'net/http/pprof'. An unauthenticated attacker can access '/debug/pprof/cmdline' to leak the metadata engine's Data Source Name (DSN), which often contains plaintext credentials for Redis, MySQL, or PostgreSQL backends. Furthermore, access to profiling endpoints allows for remote resource exhaustion (DoS). The issue is resolved in commit a46979c by migrating to dedicated 'http.ServeMux' instances for each service.
Affected products
- Juicedata JuiceFS Up to and including 1.3.1
Timeline
- 2026-05-26: disclosed: Vulnerability reported to vendor via email
- 2026-07-01: other: Public issue opened on GitHub
- 2026-07-02: patched: Fix merged in commit a46979c
- 2026-07-02: advisory: CVE published to NVD