CVE-2026-112159 Details
Description
A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.
A command injection vulnerability has been identified in JumpServer versions through 4.10.19, specifically within the template rendering component. The issue arises from inadequate validation of asset address inputs, allowing for the injection of operating system commands. This vulnerability can be exploited remotely, and has been publicly disclosed.
Users can upgrade to JumpServer version 5.0.0 or later to address this vulnerability. Version 5.1.0 is also available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Seikruun/b628bb6d4403d9c41a54a4b92d775583 | [email protected] | Exploit |
| https://github.com/jumpserver/jumpserver/ | [email protected] | ProductVendor |
| https://github.com/jumpserver/jumpserver/commit/fcf2904cdb884230e9676f50f37a44d09fa97040 | [email protected] | Source CodeVendor |
| https://github.com/jumpserver/jumpserver/pull/17500/ | [email protected] | Issue TrackingVendor |
| https://github.com/jumpserver/jumpserver/releases/tag/v5.0.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-112159 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/964676 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422286 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/422286/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JumpServer | <= 4.10.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |