JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked
Priority LOW 24CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information disclosure and exposing sensitive data. This vulnerability is fixed in v3.10.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jumpserver | jumpserver | 3.0.0 – 3.10.5 | — | No fix listed | CNA |
- jumpserver Vendorjumpserver Affected 3.0.0 – 3.10.5 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* | 3.0.0 to before 3.10.6 | Vulnerable | 1Panel-dev |
- cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.10.6 Vulnerable ·1Panel-dev
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29020
References
More jumpserver vulnerabilities
- TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2023-23378 Non-MFA account takeover via using only SSH public key to login in jumpserver CVSS 3.1CRITICAL 9.1
- TI-2023-22607 JumpServer session replays download without authentication CVSS 3.1HIGH 8.2
- TI-2024-27041 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2024-19371 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVSS 3.1CRITICAL 10.0
- TI-2024-19370 JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVSS 3.1CRITICAL 10.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences