Vulnerability Description
JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Juicedata | Juicefs | <= 1.3.1 |
Related Weaknesses (CWE)
References
- https://github.com/juicedata/juicefs/commit/a46979cdd4082217081ee99b931ddc53d038Patch
- https://github.com/juicedata/juicefs/issues/7213Vendor Advisory
- https://github.com/juicedata/juicefs/pull/7214Issue Tracking
- https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-andThird Party Advisory
FAQ
What is CVE-2026-59092?
CVE-2026-59092 is a vulnerability with a CVSS score of 7.7 (HIGH). JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiti...
How severe is CVE-2026-59092?
CVE-2026-59092 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59092?
Check the references section above for vendor advisories and patch information. Affected products include: Juicedata Juicefs.