CVE-2026-59092

Katalog CVE

CVSS 9.8 · Critical EPSS 0,66%

Kerentanan Active Debug Code pada juicedata juicefs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.

Rincian

Terbit di NVD

2 Juli 2026

Terakhir diubah

17 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-489: Active Debug Code

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/juicedata/juicefs/issues/7213 advisory vendor
• https://github.com/juicedata/juicefs/commit/a46979cdd4082217081ee99b931ddc53d038e47a patch
• https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-and-metrics-endpoints advisory pihak ketiga
• https://github.com/juicedata/juicefs/pull/7214 issue tracking