The vulnerability in Juggle 1.6.0 enables attackers to run arbitrary operating‑system commands without authentication. By connecting to the exposed H2 database web console and using the default credentials that ship with the distribution, an attacker can exploit the database's CREATE ALIAS feature combined with Runtime.exec() to spawn shell commands. When the stock Docker image is used, this results in root‑level code execution, giving the attacker full control of the host system.

The affected product is Juggle by somta, version 1.6.0. Any deployment of that version that exposes the /h2-console endpoint using the default credentials is vulnerable. This includes the unmodified Docker image available from the project's repository.

The CVSS score of 9.3 categorizes this flaw as Critical, and the EPSS score of 4% indicates a low but non‑zero probability of exploitation. Because the console is reachable over the network and no authentication is required beyond default credentials, attackers can bypass access controls (CWE‑306) and lift privileges to the root level. The flaw is not currently listed in CISA's KEV catalog, but the exposure of the H2 console via an unauthenticated endpoint makes exploitation straightforward for anyone who discovers the URL. Therefore, organizations must treat this as a high‑risk vulnerability that can lead to full system compromise if left unpatched.