JumpServer Koko vulnerable to Command Injection for Kubernetes Connection
Priority MEDIUM 44CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00848 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed jumpserver (jumpserver): 2.28.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jumpserver | jumpserver | before 2.28.8 | 2.28.8 | Patch available | CNA |
- jumpserver Vendorjumpserver Affected before 2.28.8 Fixed in 2.28.8 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* | before 2.28.8 | Vulnerable | 1Panel-dev |
| cpe:2.3:a:fit2cloud:koko:-:*:*:*:*:go:*:* | not specified by NVD | Vulnerable | 1Panel-dev |
- cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* Versions before 2.28.8 Vulnerable ·1Panel-dev
- cpe:2.3:a:fit2cloud:koko:-:*:*:*:*:go:*:* Versions not specified by NVD Vulnerable ·1Panel-dev
Remediation
- Fix · CNA jumpserver (jumpserver) Fixed in 2.28.8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28110
References
More jumpserver vulnerabilities
- TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2023-23378 Non-MFA account takeover via using only SSH public key to login in jumpserver CVSS 3.1CRITICAL 9.1
- TI-2023-22607 JumpServer session replays download without authentication CVSS 3.1HIGH 8.2
- TI-2024-27041 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2024-19371 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVSS 3.1CRITICAL 10.0
- TI-2024-19370 JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVSS 3.1CRITICAL 10.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences