Which versions of Juicefs are affected by CVE-2026-59092?

JuiceFS versions through 1.3.1 expose debug endpoints that leak database credentials and grant attackers complete read-write control over filesystem metadata.. A patch is available.

How to fix or mitigate CVE-2026-59092?

Within 24 hours: Inventory all JuiceFS deployments and identify instances running version 1.3.1 or earlier; assess current network exposure of debug endpoints (/debug/pprof/, Prometheus metrics). Within 7 days: Apply the vendor-released patch to all vulnerable JuiceFS instances. Within 30 days: Complete patch validation, implement network-level restrictions to debug endpoints (admin access only), and review audit logs for unauthorized access attempts.

Juicefs CVE-2026-59092

Q: What is the CVSS score of CVE-2026-59092?

CVE-2026-59092 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41423 HIGH

Active Debug Code (CWE-489)

2026-07-02 VulnCheck

GHSA-fx8f-5666-vr9h

Authentication Bypass Denial Of Service Juicefs

7.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:31 vuln.today

CVSS changed

Jul 02, 2026 - 20:22 NVD

7.7 (HIGH) 7.0 (HIGH)

DescriptionCVE.org

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.

AnalysisAI

Information disclosure and denial of service in JuiceFS through 1.3.1 lets remote attackers reach Go pprof debug and Prometheus metrics endpoints that are inadvertently exposed because handlers are registered on the shared http.DefaultServeMux. By fetching /debug/pprof/cmdline an attacker recovers the process command line, which embeds the metadata engine connection string and its database credentials, effectively yielding full read/write control over filesystem metadata; other pprof and profiling handlers leak internal state and can be abused to exhaust resources. Reported by VulnCheck with an upstream fix in commit a46979c; no public exploit identified at time of analysis and it is not listed in CISA KEV.