CVE-2026-59092: JuiceFS Authentication Bypass Exposes Database Credentials

Technical summary

The vulnerability stems from improper handler registration on Go's shared http.DefaultServeMux, allowing unauthenticated access to pprof diagnostic endpoints. The /debug/pprof/cmdline endpoint exposes the process command line, which typically includes metadata engine connection strings and database credentials. Additional pprof handlers leak internal runtime state, and profiling endpoints can be abused to trigger denial of service. The flaw affects JuiceFS through version 1.3.1 and was remediated in commit a46979c.

Business impact

Unauthorized metadata engine access can lead to wholesale modification or deletion of filesystem metadata, effectively corrupting the filesystem structure accessible to legitimate users. Credential exposure puts the underlying database at direct risk. The combination of metadata tampering and DoS capability creates significant business continuity risk, particularly for deployments where JuiceFS serves as a critical storage layer. Breach of database credentials may extend compromise beyond JuiceFS itself.

Affected systems

JuiceFS installations running version 1.3.1 or earlier are affected. This includes both open-source deployments and commercial distributions using the vulnerable code path. Exposure depends on network accessibility of the debug/metrics endpoints; systems with network-level access controls may have reduced risk, though this should not be relied upon as a substitute for patching.

Exploitability

Exploitation requires only unauthenticated HTTP access to the affected JuiceFS service. No special tools, authentication, or user interaction are needed. The attack is straightforward: an attacker sends a simple HTTP GET request to /debug/pprof/cmdline to harvest credentials, then uses those credentials to access the metadata database. The low complexity and absence of barriers to entry make this vulnerability practically exploitable in most network environments.

Remediation

Upgrade JuiceFS to a patched version that includes commit a46979c or later. This commit addresses the improper handler registration by ensuring pprof and debug endpoints are not exposed on the default multiplexer without authentication. Verify the patch has been applied and restart JuiceFS services. Organizations unable to patch immediately should implement network-level access controls to restrict traffic to debug endpoints, though this is a temporary mitigation only.

Patch guidance

Apply the fix committed in a46979c or verify your JuiceFS version is newer than 1.3.1. Consult the JuiceFS project repository and official release notes to identify the specific version number containing this commit. After patching, restart all JuiceFS processes and confirm that /debug/pprof/cmdline is no longer accessible without proper authentication. Test that legitimate pprof and metrics endpoints (if exposed) still require correct credentials.

Detection guidance

Monitor HTTP access logs for requests to /debug/pprof/* endpoints, particularly /debug/pprof/cmdline. Look for requests from unexpected IP addresses or patterns indicating reconnaissance. Examine database credentials and metadata engine connection logs for unauthorized access attempts or anomalous query patterns. Query audit logs for metadata structure changes that do not correspond to legitimate application activity. Implement alerts for any HTTP 200 responses to debug endpoints from untrusted sources.

Why prioritize this

This vulnerability merits immediate attention due to the combination of unauthenticated access, credential exposure, and direct filesystem metadata compromise. The CVSS 7.7 (HIGH) score reflects high confidentiality and availability impact. Because exploitation is trivial and metadata corruption can cascade into widespread data integrity issues, this should be treated as a critical priority regardless of KEV listing status. Organizations with internet-facing or untrusted-network-adjacent JuiceFS deployments should patch as an emergency.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) is driven by high confidentiality impact (credential and internal state disclosure) and high availability impact (DoS via pprof endpoints), offset slightly by the requirement for local network access. The lack of integrity impact in the CVSS vector understates the actual business risk, as metadata tampering is a critical threat; security teams should treat this as more severe than the numeric score suggests when metadata integrity is mission-critical.

Frequently asked questions