Juggle H2 Console Default Credential RCE (CVE-2026-67208)

Technical Analysis

The vulnerability stems from the H2 database's built-in web console being exposed externally without authentication hardening, combined with the use of default shipped credentials that were never rotated. Once authenticated, an attacker can execute SQL statements including 'CREATE ALIAS' bound to 'java.lang.Runtime.exec()', a well-known H2 abuse primitive that converts SQL access into arbitrary OS command execution. Because the stock Docker image runs as root, successful exploitation grants full root-level code execution on the container, enabling lateral movement, data exfiltration, or persistent backdoor installation. This is a classic unauthenticated RCE chain (CVSS 9.8) requiring no user interaction and no prior credentials beyond the known defaults. If Juggle or similar H2-backed services are deployed as part of an AI agent's backend, RAG data store, or tool-orchestration layer, this RCE could allow attackers to hijack the agent's execution environment, exfiltrate API keys/secrets used by the agent, or manipulate agent tool outputs and retrieved data.

Affected Systems

Juggle versions up to and including 1.6.0; deployments using the default Docker image with the H2 database console enabled and default credentials unchanged; any environment where /h2-console is reachable from untrusted networks.

Indicators of Compromise

• /h2-console (exposed endpoint)
• SQL pattern: CREATE ALIAS ... AS ... java.lang.Runtime.exec()
• Default H2 credential login attempts on Juggle deployments
• Unexpected root-owned processes spawned from H2/Java service on Docker hosts

Remediation Steps

1. 1

   Upgrade Juggle

   Update to a patched version of Juggle beyond 1.6.0 once available from the vendor, or apply any published hotfix that disables or secures the H2 console.

2. 2

   Disable or restrict H2 console access

   Disable the H2 web console in production, or bind it to localhost only and place it behind network-level access controls (firewall rules, VPN, or internal-only network segments).

3. 3

   Rotate default credentials

   Immediately change all default H2 console credentials to strong, unique passwords and audit for any other default credentials shipped with the application.

4. 4

   Harden Docker deployment

   Reconfigure the container to run as a non-root user, apply least-privilege principles, and remove unnecessary exposed ports from the default image.

5. 5

   Monitor and detect exploitation

   Deploy monitoring for access to /h2-console, unusual SQL statements involving CREATE ALIAS, and unexpected process execution from database service accounts.

6. 6

   Audit exposed agent infrastructure

   For organizations running AI agents or RAG pipelines on affected infrastructure, audit for exposed API keys, rotate any credentials accessible from the compromised host, and verify agent tool integrity following any suspected exploitation.