Vulnerabilities

TI-2026-71943 CVE-2026-104126

Code injection in JumpServer Ansible templates lets users run lookups

LOW 27

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00377 Published 2026-10-13 Fixed in 4.10.17 CWE-94

TI-2026-32724 CVE-2026-44846

JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

LOW 28

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.2 Network High privileges No interaction EPSS 0.00427 Published 2026-08-17 Fixed in 4.10.17 CWE-863

TI-2026-32723 CVE-2026-44845

JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

MEDIUM 63

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00735 Published 2026-08-17 Fixed in 4.10.17 CWE-1336

TI-2026-39230 CVE-2026-54336

JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

MEDIUM 58

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00341 Published 2026-08-17 Fixed in 4.10.17 CWE-22

TI-2026-24416 CVE-2026-31864

JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering

LOW 32

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00369 Published 2026-03-13 Fixed in 3.10.22, 4.10.16 CWE-1336

TI-2026-24353 CVE-2026-31798

JumpServer Improper Certificate Validation in Custom SMS API Client

MEDIUM 56

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00101 Published 2026-03-13 Fixed in 4.10.16-lts CWE-295

TI-2025-35887 CVE-2025-58044

JumpServer has an Open Redirect Vulnerability

LOW 25

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00523 Published 2025-12-01 Fixed in 3.10.19, 4.10.5 CWE-601

TI-2025-38978 CVE-2025-62795

JumpServer Unauthorized LDAP Configuration Access via WebSocket

MEDIUM 64

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00285 Published 2025-10-30 Fixed in 3.10.21-lts, 4.10.12-lts CWE-863

TI-2025-38902 CVE-2025-62712

JumpServer Connection Token Leak Vulnerability

MEDIUM 43

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00497 Published 2025-10-30 Fixed in 4.10.11-lts, 3.10.20-lts CWE-862

TI-2025-19965 CVE-2025-27095

JumpServer has a Kubernetes Token Leak Vulnerability

MEDIUM 53

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00332 Published 2025-03-31 Fixed in 3.10.18, 4.8.0 CWE-266

TI-2024-27040 CVE-2024-40628

Arbitrary File Read in Ansible Playbooks in Jumpserver

HIGH 82

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00861 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-27041 CVE-2024-40629

Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

HIGH 76

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01272 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-19371 CVE-2024-29202

JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05939 Published 2024-03-29 No fix listed CWE-94

TI-2024-19370 CVE-2024-29201

JumpServer's insecure Ansible playbook validation leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05987 Published 2024-03-29 No fix listed CWE-94

TI-2024-19202 CVE-2024-29020

JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked

LOW 24

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00292 Published 2024-03-29 No fix listed CWE-639

TI-2024-19206 CVE-2024-29024

JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality

MEDIUM 57

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2024-03-29 No fix listed CWE-639

TI-2024-16280 CVE-2024-24763

JumpServer Open Redirect Vulnerability

LOW 29

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01057 Published 2024-02-20 Fixed in 3.10.0 CWE-601

TI-2023-24780 CVE-2023-46138

JumpServer default admin user email leak password reset

LOW 24

JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00372 Published 2023-10-30 Fixed in 3.8.0 CWE-640

TI-2023-24765 CVE-2023-46123

jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

MEDIUM 63

jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00891 Published 2023-10-25 Fixed in 3.8.0 CWE-307

TI-2023-22909 CVE-2023-42818

SSH public key login without private key challenge if mfa is enabled in jumpserver

HIGH 75

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2023-09-27 Fixed in 3.6.5, 3.5.6 CWE-287

TI-2023-23377 CVE-2023-43651 · GHSA-4r5x-x283-wm96

Remote code execution on the host system via MongoDB shell in jumpserver

HIGH 76

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02107 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-94

TI-2023-23376 CVE-2023-43650

Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver

MEDIUM 43

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00603 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-640

TI-2023-23378 CVE-2023-43652

Non-MFA account takeover via using only SSH public key to login in jumpserver

HIGH 78

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00814 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-862

TI-2023-22910 CVE-2023-42819

Path traversal in Jumpserver

HIGH 74

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.02215 Published 2023-09-26 Fixed in 3.6.5 CWE-22

TI-2023-22911 CVE-2023-42820

Random seed leakage in Jumpserver

MEDIUM 51

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.06296 Published 2023-09-26 Fixed in 2.28.19, 3.6.5 CWE-200

Vulnerabilities

Filters