Vulnerability · Published Jul 2, 2026 · Assigned by VulnCheck

CVE-2026-59092JuiceFS - Authentication Bypass via pprof and metrics Endpoints

High 7.7

In plain English

A high-severity security flaw in juicefs from juicedata. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.7%top 48.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.

Affected products (as reported)

Vendor	Product	Versions
juicedata	juicefs	0 – through 1.3.1

Weakness: CWE-489 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

GitHub Issue technical-description
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-and-metrics-endpoints third-party-advisory