juicedata juicefs up to 1.3.1 /debug/pprof/cmdline debug code

Summaryinfo

A vulnerability, which was classified as problematic, was found in juicedata juicefs up to 1.3.1. The affected element is an unknown function of the file /debug/pprof/cmdline. Such manipulation leads to debug code. This vulnerability is documented as CVE-2026-59092. The attack needs to be performed locally. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in juicedata juicefs up to 1.3.1. Affected by this issue is some unknown functionality of the file /debug/pprof/cmdline. The manipulation with an unknown input leads to a debug code vulnerability. Using CWE to declare the problem leads to CWE-489. The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information. Impacted is confidentiality, integrity, and availability. CVE summarizes:

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.

The weakness was released by George Chen as 7213. The advisory is available at github.com. This vulnerability is handled as CVE-2026-59092 since 07/02/2026. The exploitation is known to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading eliminates this vulnerability. Applying the patch a46979cdd4082217081ee99b931ddc53d038e47a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• juicedata

Name

• juicefs

Version

• 1.3.0
• 1.3.1

License

• open-source

Website

• Product: https://github.com/juicedata/juicefs/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion