Cross-workspace authorization bypass in Jpom Docker controllers
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
dromara Jpom through 2.11.12 contains a cross-workspace authorization bypass (CWE-639) in which the server trusts a user-supplied key to select Docker hosts. An authenticated user with Docker permission in any workspace can manage Docker hosts belonging to other workspaces. Such an attacker can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Jpom.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Timeline
- 2026-11-02 Threatist record created from CVE-2026-120460
- 2026-11-02 Alias added: GHSA-3m4h-jf7h-5gx2
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → LOW
- 2026-11-04 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/dromara/Jpom/issues/119
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51
More dromara vulnerabilities
- TI-2023-28043 HertzBeat AviatorScript Inject RCE CVSS 3.1CRITICAL 9.8
- TI-2023-24001 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-15126 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. CVSS 3.1CRITICAL 9.8
- TI-2025-41084 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface… CVSS 3.1CRITICAL 9.4
- TI-2026-62126 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVSS 4.0HIGH 8.7
- TI-2023-28044 HertzBeat SnakeYAML Deser RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-120460 · CVE Program
- CVE-2026-120460 · NVD
- FIRST EPSS
- GHSA-3m4h-jf7h-5gx2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences