Security

Security advisories, vulnerability disclosures, and CVE patches for JumpServer open-source bastion host. Stay informed about the latest security updates and remediation guidance.

2 articles

All Best Practices Security Product Knowledge Usage Guide Troubleshooting Guide Case Studies Tutorials News Blog

Security

Important Notice: JumpServer Vulnerability Advisory and Remediation (JS-2026.09.09)

JumpServer security advisory JS-2026.09.09: an improper API filtering vulnerability (GHSA-6rp5-ff2m-qfrm, High, CVSS 8.8) lets any authenticated user retrieve administrator Access Keys by appending a query parameter. Affects V3 >= v3.7.0 and < v3.10.23 LTS, and V4 >= v4.0.0 and < v4.10.19 LTS. Upgrade or apply the Nginx workaround immediately.

Sep 09, 2026 Cybersecurity JumpServer

Security

Important Notice: JumpServer Vulnerability Advisory and Remediation (JS-2026.7.29)

JumpServer security advisory JS-2026.7.29: Four vulnerabilities identified — CVE-2026-16723 (Fastjson in Chen), CVE-2026-54336 (KoKo SFTP path traversal), CVE-2026-44845 (Applet Host Jinja template injection RCE), CVE-2026-44846 (organization invitation permission override). Affects V3 < v3.10.22 LTS and V4 < v4.10.17 LTS. Upgrade to safe versions immediately.

Aug 03, 2026 Cybersecurity JumpServer