CVE-2026-67208 affects somta Juggle through version 1.6.0 and involves missing authentication on the H2 database web console endpoint (/h2-console). Attackers can authenticate with default shipped credentials and exploit the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary operating system commands remotely. This leads to remote code execution with root privileges in the stock Docker image environment. The vulnerability is remotely exploitable without user interaction and requires no privileges, making it highly critical. No vendor advisory or patch information is available at this time.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges on affected systems running the stock Docker image of Juggle. This can lead to full system compromise, data loss, or further network penetration. The vulnerability is critical due to ease of exploitation and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should disable or restrict access to the /h2-console endpoint, change default credentials, or avoid using the stock Docker image in production environments. Monitor for updates from the vendor regarding patches or official mitigations.