Read the docs
TI-2026-71943 Aliases CVE-2026-104126

Code injection in JumpServer Ansible templates lets users run lookups

Priority LOW 27CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

JumpServer versions before 4.10.17-lts are affected. Its Ansible-based automation rendering evaluates attacker-controlled template expressions (CWE-94). A user with permission to create or execute affected automation tasks can invoke Ansible lookups such as file, pipe, env and password to disclose files or environment values, and may run limited commands under the automation process privileges. The issue does not provide unauthenticated access.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation tasks. Crafted content can invoke sensitive Ansible lookup behavior, including file, pipe, env, and password lookups, within the Ansible execution context, which can disclose files or environment values and may permit limited command execution under the privileges of the automation process. The issue does not provide unauthenticated access or direct access to unrelated JumpServer assets. This issue is fixed in version 4.10.17-lts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed jumpserver (jumpserver): 4.10.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jumpserverjumpserverbefore 4.10.174.10.17Patch availableCNA
  • jumpserver Vendorjumpserver Affected before 4.10.17 Fixed in 4.10.17 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*——1Panel-dev
  • cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:* Versions — — ·1Panel-dev

Remediation

Upgrade JumpServer to version 4.10.17-lts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

  • Fix · CNA jumpserver (jumpserver) Fixed in 4.10.17

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-104126
  2. 2026-10-14 Priority changed: MEDIUM → LOW
  3. 2026-10-18 CISA SSVC decision points changed

References

Other 4

  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2023-23378 Non-MFA account takeover via using only SSH public key to login in jumpserver CVSS 3.1CRITICAL 9.1
  • TI-2023-22607 JumpServer session replays download without authentication CVSS 3.1HIGH 8.2
  • TI-2024-27041 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-19371 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVSS 3.1CRITICAL 10.0
  • TI-2024-19370 JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVSS 3.1CRITICAL 10.0
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences