JumpServer vulnerabilities
We track 13 vulnerabilities in JumpServer products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2025.
Latest JumpServer vulnerabilities
- 7.1 High severity
jumpserver: Incorrect Authorization
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configuration tests and start LDAP synchronization by sending crafted
- 8.1 High severity
jumpserver: Missing Authorization
JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via t
- 9.8 Critical severity
jumpserver: Improper Limitation of a Pathname to a Restricted Directory
JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playboo
- 9.1 Critical severity
jumpserver: Improper Limitation of a Pathname to a Restricted Directory
JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the ansible playboo
- 9.9 Critical severity
jumpserver: Improper Control of Generation of Code
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery co
- 9.9 Critical severity
jumpserver: Improper Control of Generation of Code
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs
- 9.9 Critical severity
jumpserver: Improper Control of Generation of Code
JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system.
- 9.8 Critical severity
jumpserver: Improper Restriction of Excessive Authentication Attempts
JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to at
- 9.1 Critical severity
jumpserver: Missing Authorization
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered
- 7.4 High severity
jumpserver: Weak Password Recovery Mechanism for Forgotten Password
JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users a
- 8.2 High severity
jumpserver: Exposure of Sensitive Information to an Unauthorized Actor
JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are
- 8.8 High severity
jumpserver: Improper Limitation of a Pathname to a Restricted Directory
JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-49
- 9.9 Critical severity
jumpserver: Improper Neutralization of Special Elements used in a Command
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster