Product by 1Panel-dev
Jumpserver
24 known vulnerabilities in Jumpserver (1Panel-dev), 0 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
10
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-29201 | JumpServer's insecure Ansible playbook validation leads to RCE in Celery | 10.0 | |
| Critical | CVE-2024-29202 | JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery | 10.0 | |
| High | CVE-2023-42442 | JumpServer session replays download without authentication | 8.2 | |
| High | CVE-2023-42820 | Random seed leakage in Jumpserver | 7.0 | |
| Critical | CVE-2023-48193 | 1Panel-dev Jumpserver: Code Execution | 9.8 | |
| High | CVE-2023-42819 | Path traversal in Jumpserver | 8.9 | |
| Critical | CVE-2023-43651 | Remote code execution on the host system via MongoDB shell in jumpserver | 8.6 | |
| Critical | CVE-2024-40629 | Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver | 10.0 | |
| Critical | CVE-2024-40628 | Arbitrary File Read in Ansible Playbooks in Jumpserver | 10.0 | |
| Critical | CVE-2025-62712 | JumpServer Connection Token Leak Vulnerability | 9.6 | |
| Critical | CVE-2023-43652 | Non-MFA account takeover via using only SSH public key to login in jumpserver | 8.2 | |
| High | CVE-2023-43650 | Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver | 8.2 | |
| Medium | CVE-2024-24763 | JumpServer Open Redirect Vulnerability | 4.3 | |
| Medium | CVE-2025-58044 | JumpServer has an Open Redirect Vulnerability | 6.1 | |
| Medium | CVE-2023-46123 | jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values | 5.3 | |
| Critical | CVE-2023-28110 | JumpServer Koko vulnerable to Command Injection for Kubernetes Connection | 5.7 | |
| Medium | CVE-2026-31864 | JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering | 6.8 | |
| Critical | CVE-2023-42818 | SSH public key login without private key challenge if mfa is enabled in jumpserver | 5.4 | |
| High | CVE-2025-62795 | JumpServer Unauthorized LDAP Configuration Access via WebSocket | 7.1 | |
| Medium | CVE-2026-31798 | JumpServer Improper Certificate Validation in Custom SMS API Client | 5.0 | |
| Medium | CVE-2025-27095 | JumpServer has a Kubernetes Token Leak Vulnerability | 4.3 | |
| Medium | CVE-2024-29020 | Jumpserver: Authorization Bypass Through User-Controlled Key | 4.6 | |
| Medium | CVE-2023-46138 | JumpServer default admin user email leak password reset | 3.7 | |
| Medium | CVE-2024-29024 | JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality | 4.6 |