CVE-2026-59092

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/juicedata/juicefs/commit/a46979cdd4082217081ee99b931ddc53d038e47a	Patch
https://github.com/juicedata/juicefs/issues/7213	Vendor Advisory
https://github.com/juicedata/juicefs/pull/7214	Issue Tracking
https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-and-metrics-endpoints	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:juicedata:juicefs:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) JuiceFS hasta 1.3.1, corregido en el commit a46979c, contiene una vulnerabilidad de omisión de autenticación que permite a atacantes remotos no autenticados acceder a puntos finales sensibles de depuración y métricas explotando un registro de gestor incorrecto en el http.DefaultServeMux compartido. Los atacantes pueden solicitar el punto final /debug/pprof/cmdline para obtener la línea de comandos del proceso que contiene cadenas de conexión del motor de metadatos con credenciales de base de datos, otorgando acceso completo de lectura/escritura a los metadatos del sistema de archivos, mientras que otros gestores pprof filtran el estado interno y los gestores de perfilado permiten la denegación de servicio.

Information

Published : 2026-07-02 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-59092

Mitre link : CVE-2026-59092

CVE.ORG link : CVE-2026-59092

JSON object : View

Products Affected

juicedata

juicefs

CWE

CWE-489

Active Debug Code

{"id": "CVE-2026-59092", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59092", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T16:37:40.183091Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/juicedata/juicefs", "vendor": "juicedata", "product": "juicefs", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.1"}, {"status": "unaffected", "version": "a46979cdd4082217081ee99b931ddc53d038e47a", "versionType": "git"}], "packageURL": "pkg:github/juicedata/juicefs", "defaultStatus": "unaffected"}]}], "published": "2026-07-02T20:17:07.270", "references": [{"url": "https://github.com/juicedata/juicefs/commit/a46979cdd4082217081ee99b931ddc53d038e47a", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/juicedata/juicefs/issues/7213", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/juicedata/juicefs/pull/7214", "tags": ["Issue Tracking"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-and-metrics-endpoints", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-489"}]}], "descriptions": [{"lang": "en", "value": "JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service."}, {"lang": "es", "value": "JuiceFS hasta 1.3.1, corregido en el commit a46979c, contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n que permite a atacantes remotos no autenticados acceder a puntos finales sensibles de depuraci\u00f3n y m\u00e9tricas explotando un registro de gestor incorrecto en el http.DefaultServeMux compartido. Los atacantes pueden solicitar el punto final /debug/pprof/cmdline para obtener la l\u00ednea de comandos del proceso que contiene cadenas de conexi\u00f3n del motor de metadatos con credenciales de base de datos, otorgando acceso completo de lectura/escritura a los metadatos del sistema de archivos, mientras que otros gestores pprof filtran el estado interno y los gestores de perfilado permiten la denegaci\u00f3n de servicio."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:juicedata:juicefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC75174A-B7FD-450E-9649-91BCF6574AFD", "versionEndIncluding": "1.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}