JuiceFS versions prior to 1.3.1 contain an authentication bypass that arises from improper handler registration on the shared http.DefaultServeMux, allowing attackers to access internal debugging and metrics endpoints without authentication. The exposed /debug/pprof/cmdline endpoint reveals the running process’s command line, which includes the metadata engine connection string and database credentials, giving an attacker full read/write access to the filesystem’s metadata. Other pprof handlers can leak internal process state or be used to exhaust system resources, creating a potential denial‑of‑service vector.

The distributed file system from juicedata, JuiceFS, is affected for all releases up through 1.3.1. The vulnerability applies regardless of the underlying storage backend and impacts any deployment that exposes the embedded HTTP /debug/pprof and /metrics URLs to external or internal networks.

The CVSS score of 7.0 reflects moderate severity. Exploitation requires only unauthenticated HTTP requests to the vulnerable endpoints, making it broadly reachable by anyone with network access to the service. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, but the risk remains for exposed services. The vulnerability is not listed in CISA’s KEV catalog. If left unmitigated, attackers could read or modify critical metadata, exfiltrate credentials, or disrupt service availability.