CVE-2026-59092

creationtimestamp| type| source ---|---|--- 2026-07-03 15:05:40+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpqt322vpe2l 2026-07-03 15:09:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqtcm3jca2n...

CVE-2026-59092

JuiceFS versions before 1.3.2 are vulnerable to authentication bypass via improper registration on http.DefaultServeMux, exposing /debug/pprof/cmdline and leaking database credentials and metadata engine connection strings. Profiling handlers also enable denial of service. Upgrade to 1.3.2 or lat...

CVE-2026-59092

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the...