Vulnerabilities

TI-2026-24416 CVE-2026-31864

JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

LOW 32

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00369 Published 2026-03-13 Fixed in 3.10.22, 4.10.16 CWE-1336

TI-2026-24353 CVE-2026-31798

JumpServer Improper Certificate Validation in Custom SMS API Client

MEDIUM 56

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00101 Published 2026-03-13 Fixed in 4.10.16-lts CWE-295

TI-2025-35887 CVE-2025-58044

JumpServer has an Open Redirect Vulnerability

LOW 25

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00523 Published 2025-12-01 Fixed in 3.10.19, 4.10.5 CWE-601

TI-2025-38978 CVE-2025-62795

JumpServer Unauthorized LDAP Configuration Access via WebSocket

MEDIUM 64

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00285 Published 2025-10-30 Fixed in 3.10.21-lts, 4.10.12-lts CWE-863

TI-2025-38902 CVE-2025-62712

JumpServer Connection Token Leak Vulnerability

MEDIUM 43

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00497 Published 2025-10-30 Fixed in 4.10.11-lts, 3.10.20-lts CWE-862

TI-2025-19965 CVE-2025-27095

JumpServer has a Kubernetes Token Leak Vulnerability

MEDIUM 53

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00332 Published 2025-03-31 Fixed in 3.10.18, 4.8.0 CWE-266

TI-2024-27040 CVE-2024-40628

Arbitrary File Read in Ansible Playbooks in Jumpserver

HIGH 82

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00861 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-27041 CVE-2024-40629

Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

HIGH 76

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01272 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-19371 CVE-2024-29202

JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05939 Published 2024-03-29 No fix listed CWE-94

TI-2024-19370 CVE-2024-29201

JumpServer's insecure Ansible playbook validation leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05987 Published 2024-03-29 No fix listed CWE-94

TI-2024-19202 CVE-2024-29020

JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked

LOW 24

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00292 Published 2024-03-29 No fix listed CWE-639

TI-2024-19206 CVE-2024-29024

JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality

MEDIUM 57

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2024-03-29 No fix listed CWE-639

TI-2024-16280 CVE-2024-24763

JumpServer Open Redirect Vulnerability

LOW 29

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01057 Published 2024-02-20 Fixed in 3.10.0 CWE-601

TI-2023-26068 CVE-2023-48193 · GHSA-j544-j388-44c3

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker…

MEDIUM 46

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01979 Published 2023-11-28 No fix listed

TI-2023-24780 CVE-2023-46138

JumpServer default admin user email leak password reset

LOW 24

JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00372 Published 2023-10-30 Fixed in 3.8.0 CWE-640

TI-2023-24765 CVE-2023-46123

jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

MEDIUM 63

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00891 Published 2023-10-25 Fixed in 3.8.0 CWE-307

TI-2023-22909 CVE-2023-42818

SSH public key login without private key challenge if mfa is enabled in jumpserver

HIGH 75

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2023-09-27 Fixed in 3.6.5, 3.5.6 CWE-287

TI-2023-23377 CVE-2023-43651 · GHSA-4r5x-x283-wm96

Remote code execution on the host system via MongoDB shell in jumpserver

HIGH 76

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02107 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-94

TI-2023-23376 CVE-2023-43650

Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

MEDIUM 43

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00603 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-640

TI-2023-23378 CVE-2023-43652

Non-MFA account takeover via using only SSH public key to login in jumpserver

HIGH 78

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00814 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-862

TI-2023-22910 CVE-2023-42819

Path traversal in Jumpserver

HIGH 74

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.02215 Published 2023-09-26 Fixed in 3.6.5 CWE-22

TI-2023-22911 CVE-2023-42820

Random seed leakage in Jumpserver

MEDIUM 51

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.06296 Published 2023-09-26 Fixed in 2.28.19, 3.6.5 CWE-200

TI-2023-22607 CVE-2023-42442

JumpServer session replays download without authentication

HIGH 77

JumpServer is an open source bastion host and a professional operation and maintenance security audit system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.63027 Published 2023-09-15 Fixed in 3.5.5, 3.6.4 CWE-287

TI-2023-12689 CVE-2023-28110

JumpServer Koko vulnerable to Command Injection for Kubernetes Connection

MEDIUM 44

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00848 Published 2023-03-16 Fixed in 2.28.8 CWE-77

Vulnerabilities

Filters