Fit2cloud Jumpserver vulnerabilities

• fit2cloud jumpserver JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering CVE-2026-31864 6.8 MediumMarch 13, 2026
• fit2cloud jumpserver JumpServer Improper Certificate Validation in Custom SMS API Client CVE-2026-31798 5.0 MediumMarch 13, 2026
• fit2cloud jumpserver JumpServer has an Open Redirect Vulnerability CVE-2025-58044 5.5 MediumDecember 1, 2025
• fit2cloud jumpserver JumpServer Unauthorized LDAP Configuration Access via WebSocket CVE-2025-62795 7.1 HighOctober 30, 2025
• fit2cloud jumpserver JumpServer Connection Token Leak Vulnerability CVE-2025-62712 9.6 CriticalOctober 30, 2025
• fit2cloud jumpserver JumpServer has a Kubernetes Token Leak Vulnerability CVE-2025-27095 4.3 MediumMarch 31, 2025
• fit2cloud jumpserver Arbitrary File Read in Ansible Playbooks in Jumpserver CVE-2024-40628 10.0 CriticalJuly 18, 2024
• fit2cloud jumpserver Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver CVE-2024-40629 10.0 CriticalJuly 18, 2024
• fit2cloud jumpserver JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery CVE-2024-29202 10.0 CriticalMarch 29, 2024
• fit2cloud jumpserver JumpServer's insecure Ansible playbook validation leads to RCE in Celery CVE-2024-29201 10.0 CriticalMarch 29, 2024
• fit2cloud jumpserver JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked CVE-2024-29020 4.6 MediumMarch 29, 2024
• fit2cloud jumpserver JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality CVE-2024-29024 4.6 MediumMarch 29, 2024
• fit2cloud jumpserver JumpServer Open Redirect Vulnerability CVE-2024-24763 4.3 MediumFebruary 20, 2024
• fit2cloud jumpserver Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to... CVE-2023-48193 Disputed 9.8 CriticalNovember 28, 2023
• fit2cloud jumpserver JumpServer default admin user email leak password reset CVE-2023-46138 3.7 LowOctober 30, 2023
• fit2cloud jumpserver jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values CVE-2023-46123 5.3 MediumOctober 25, 2023
• fit2cloud jumpserver SSH public key login without private key challenge if mfa is enabled in jumpserver CVE-2023-42818 Fix available 5.4 MediumSeptember 27, 2023
• fit2cloud jumpserver Remote code execution on the host system via MongoDB shell in jumpserver CVE-2023-43651 Fix available 8.6 HighSeptember 27, 2023
• fit2cloud jumpserver Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver CVE-2023-43650 8.2 HighSeptember 27, 2023
• fit2cloud jumpserver Non-MFA account takeover via using only SSH public key to login in jumpserver CVE-2023-43652 8.2 HighSeptember 27, 2023
• fit2cloud jumpserver Path traversal in Jumpserver CVE-2023-42819 Public exploit 8.9 HighSeptember 26, 2023
• fit2cloud jumpserver Random seed leakage in Jumpserver CVE-2023-42820 Public exploit 7.0 HighSeptember 26, 2023
• fit2cloud jumpserver JumpServer session replays download without authentication CVE-2023-42442 Public exploit EPSS 63.0% 8.2 HighSeptember 15, 2023
• fit2cloud jumpserver, koko +1 more JumpServer Koko vulnerable to Command Injection for Kubernetes Connection CVE-2023-28110 5.7 MediumMarch 16, 2023