jumpserver

Records28All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical10CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

jumpserver records in CISA KEV

No jumpserver vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jumpserver 1 record MEDIUM

Records

28 records

TI-2024-27040 CVE-2024-40628

Arbitrary File Read in Ansible Playbooks in Jumpserver

HIGH 82

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00861 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2023-23378 CVE-2023-43652

Non-MFA account takeover via using only SSH public key to login in jumpserver

HIGH 78

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00814 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-862

TI-2023-22607 CVE-2023-42442

JumpServer session replays download without authentication

HIGH 77

JumpServer is an open source bastion host and a professional operation and maintenance security audit system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.63027 Published 2023-09-15 Fixed in 3.5.5, 3.6.4 CWE-287

TI-2024-27041 CVE-2024-40629

Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

HIGH 76

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01272 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-19371 CVE-2024-29202

JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05939 Published 2024-03-29 No fix listed CWE-94

TI-2024-19370 CVE-2024-29201

JumpServer's insecure Ansible playbook validation leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05987 Published 2024-03-29 No fix listed CWE-94

TI-2023-23377 CVE-2023-43651 · GHSA-4r5x-x283-wm96

Remote code execution on the host system via MongoDB shell in jumpserver

HIGH 76

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02107 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-94

TI-2023-22909 CVE-2023-42818

SSH public key login without private key challenge if mfa is enabled in jumpserver

HIGH 75

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2023-09-27 Fixed in 3.6.5, 3.5.6 CWE-287

TI-2023-22910 CVE-2023-42819

Path traversal in Jumpserver

HIGH 74

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.02215 Published 2023-09-26 Fixed in 3.6.5 CWE-22

TI-2025-38978 CVE-2025-62795

JumpServer Unauthorized LDAP Configuration Access via WebSocket

MEDIUM 64

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00285 Published 2025-10-30 Fixed in 3.10.21-lts, 4.10.12-lts CWE-863

TI-2026-32723 CVE-2026-44845

JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

MEDIUM 63

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00735 Published 2026-08-17 Fixed in 4.10.17 CWE-1336

TI-2023-24765 CVE-2023-46123

jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

MEDIUM 63

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00891 Published 2023-10-25 Fixed in 3.8.0 CWE-307

TI-2026-39230 CVE-2026-54336

JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

MEDIUM 58

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00341 Published 2026-08-17 Fixed in 4.10.17 CWE-22

TI-2024-19206 CVE-2024-29024

JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality

MEDIUM 57

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2024-03-29 No fix listed CWE-639

TI-2026-24353 CVE-2026-31798

JumpServer Improper Certificate Validation in Custom SMS API Client

MEDIUM 56

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00101 Published 2026-03-13 Fixed in 4.10.16-lts CWE-295

TI-2025-19965 CVE-2025-27095

JumpServer has a Kubernetes Token Leak Vulnerability

MEDIUM 53

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00332 Published 2025-03-31 Fixed in 3.10.18, 4.8.0 CWE-266

TI-2023-22911 CVE-2023-42820

Random seed leakage in Jumpserver

MEDIUM 51

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.06296 Published 2023-09-26 Fixed in 2.28.19, 3.6.5 CWE-200

TI-2021-02251 CVE-2021-3169 · GHSA-h699-2469-3vhg

An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to…

MEDIUM 47

An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0275 Published 2021-07-23 No fix listed CWE-74

TI-2023-12689 CVE-2023-28110

JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

MEDIUM 44

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00848 Published 2023-03-16 Fixed in 2.28.8 CWE-77

TI-2025-38902 CVE-2025-62712

JumpServer Connection Token Leak Vulnerability

MEDIUM 43

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00497 Published 2025-10-30 Fixed in 4.10.11-lts, 3.10.20-lts CWE-862

TI-2023-23376 CVE-2023-43650

Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

MEDIUM 43

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00603 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-640

TI-2026-24416 CVE-2026-31864

JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

LOW 32

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00369 Published 2026-03-13 Fixed in 3.10.22, 4.10.16 CWE-1336

TI-2024-16280 CVE-2024-24763

JumpServer Open Redirect Vulnerability

LOW 29

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01057 Published 2024-02-20 Fixed in 3.10.0 CWE-601

TI-2026-32724 CVE-2026-44846

JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

LOW 28

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.00427 Published 2026-08-17 Fixed in 4.10.17 CWE-863

TI-2026-71943 CVE-2026-104126

Code injection in JumpServer Ansible templates lets users run lookups

LOW 27

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00377 Published 2026-10-13 Fixed in 4.10.17 CWE-94

Open these records in search →