Executive brief
Juggle, a project management or workflow tool, contains a critical security flaw where its internal database management console is exposed to the internet without proper protection. Attackers can use default, publicly known passwords to log into this console and take full control of the underlying server. This could lead to a complete system takeover, theft of sensitive data, and the ability to disrupt business operations.
Technical details
Juggle (through version 1.6.0) is vulnerable to unauthenticated Remote Code Execution (RCE) due to the H2 database web console being exposed with insecure defaults. The application ships with 'spring.h2.console.enabled=true' and 'spring.h2.console.settings.web-allow-others=true', while the custom AuthInterceptor fails to cover the '/h2-console' endpoint. An attacker can access the console and authenticate using the default credentials (sa/juggle). Once authenticated, the attacker can use the 'CREATE ALIAS' H2 SQL command to invoke 'java.lang.Runtime.getRuntime().exec()', leading to OS command execution. In the official Docker image, this results in root-level privileges.
Affected products
- somta Juggle <= 1.6.0
Timeline
- 2026-07-30: disclosed: Vulnerability reported via GitHub issues and VulnCheck advisory.
- 2026-07-30: advisory