Read the docs
TI-2026-24353 Aliases CVE-2026-31798

JumpServer Improper Certificate Validation in Custom SMS API Client

Priority MEDIUM 56CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00101 0th percentileScored 2026-11-07
Fix Fixed jumpserver (jumpserver): 4.10.16-lts

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jumpserverjumpserverbefore 4.10.16-lts4.10.16-ltsPatch availableCNA
  • jumpserver Vendorjumpserver Affected before 4.10.16-lts Fixed in 4.10.16-lts Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*before 4.10.16Vulnerable1Panel-dev
  • cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* Versions before 4.10.16 Vulnerable ·1Panel-dev

Remediation

  • Fix · CNA jumpserver (jumpserver) Fixed in 4.10.16-lts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-31798

References

Advisory 1

  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2023-23378 Non-MFA account takeover via using only SSH public key to login in jumpserver CVSS 3.1CRITICAL 9.1
  • TI-2023-22607 JumpServer session replays download without authentication CVSS 3.1HIGH 8.2
  • TI-2024-27041 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-19371 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVSS 3.1CRITICAL 10.0
  • TI-2024-19370 JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVSS 3.1CRITICAL 10.0
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences