Jumpserver vulnerabilities
27 CVEs and advisories name Jumpserver as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-104126JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation
- CVE-2026-44846JumpServer: Privilege Overwrite via Organization Invite Logic Flaw
- CVE-2026-44845JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment
- CVE-2026-54336JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
- CVE-2026-31864JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering
- CVE-2026-31798JumpServer Improper Certificate Validation in Custom SMS API Client
- CVE-2025-58044JumpServer has an Open Redirect Vulnerability
- CVE-2025-62795JumpServer Unauthorized LDAP Configuration Access via WebSocket
- CVE-2025-62712JumpServer Connection Token Leak Vulnerability
- CVE-2025-27095JumpServer has a Kubernetes Token Leak Vulnerability
- CVE-2024-40628Arbitrary File Read in Ansible Playbooks in Jumpserver
- CVE-2024-40629Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
- CVE-2024-29202JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2024-29201JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29020JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked
- CVE-2024-29024JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality
- CVE-2024-24763JumpServer Open Redirect Vulnerability
- CVE-2023-46138JumpServer default admin user email leak password reset
- CVE-2023-46123jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values
- CVE-2023-42818SSH public key login without private key challenge if mfa is enabled in jumpserver
- CVE-2023-43651Remote code execution on the host system via MongoDB shell in jumpserver
- CVE-2023-43650Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver
- CVE-2023-43652Non-MFA account takeover via using only SSH public key to login in jumpserver
- CVE-2023-42819Path traversal in Jumpserver
- CVE-2023-42820Random seed leakage in Jumpserver
- CVE-2023-42442JumpServer session replays download without authentication
- CVE-2023-28110JumpServer Koko vulnerable to Command Injection for Kubernetes Connection