JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.
Summary
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment and execute arbitrary commands on the JumpServer control node. This issue is fixed in version 4.10.17.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jumpserver | jumpserver | before 4.10.17 | 4.10.17 | Patch available | CNA |
- jumpserver Vendorjumpserver Affected before 4.10.17 Fixed in 4.10.17 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* | — | — | 1Panel-dev |
- cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* Versions — — ·1Panel-dev
Remediation
- Fix · CNA jumpserver (jumpserver) Fixed in 4.10.17
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44845
References
Other 5
- https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q
- https://github.com/jumpserver/jumpserver/pull/16749
- https://github.com/jumpserver/jumpserver/pull/16886
- https://github.com/jumpserver/jumpserver/commit/cc57ba0de5f6015746fae11cfc62402b11618e59
- https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17
More jumpserver vulnerabilities
- TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2023-23378 Non-MFA account takeover via using only SSH public key to login in jumpserver CVSS 3.1CRITICAL 9.1
- TI-2023-22607 JumpServer session replays download without authentication CVSS 3.1HIGH 8.2
- TI-2024-27041 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2024-19371 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVSS 3.1CRITICAL 10.0
- TI-2024-19370 JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVSS 3.1CRITICAL 10.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences