JuiceFS through 1.3.1 contains an authentication bypass in its HTTP debug/metrics handler registration. Because handlers are registered on the shared http.DefaultServeMux, unauthenticated remote attackers can access sensitive /debug/pprof/* and metrics endpoints. The /debug/pprof/cmdline endpoint can leak process command-line arguments that include metadata engine connection strings with database credentials, enabling full read/write access to filesystem metadata. Other pprof handlers leak internal state and profiling handlers can be abused for denial-of-service.