Cross-workspace authorization bypass in Jpom SSH command batch
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Jpom through 2.11.12 contains a cross-workspace authorization bypass in the POST /node/ssh_command/batch endpoint, which resolves command templates and SSH nodes by ID without workspace filtering (CWE-639). An authenticated user with SSH command execute permission in one workspace can supply template and node IDs from other workspaces to run commands on those workspaces' SSH hosts using their stored credentials.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Jpom.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Timeline
- 2026-11-02 Threatist record created from CVE-2026-120461
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: MEDIUM → LOW
- 2026-11-02 Alias added: GHSA-xxr5-rv8h-2q24
- 2026-11-04 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/dromara/Jpom/issues/120
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169
More dromara vulnerabilities
- TI-2023-28043 HertzBeat AviatorScript Inject RCE CVSS 3.1CRITICAL 9.8
- TI-2023-24001 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-15126 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. CVSS 3.1CRITICAL 9.8
- TI-2025-41084 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface… CVSS 3.1CRITICAL 9.4
- TI-2026-62126 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVSS 4.0HIGH 8.7
- TI-2023-28044 HertzBeat SnakeYAML Deser RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-120461 · CVE Program
- CVE-2026-120461 · NVD
- FIRST EPSS
- GHSA-xxr5-rv8h-2q24 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences