CVE-2026-123965

CRITICAL 9.9

Jet Admin cloud platform prompt injection

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.

CWE	CWE-200
Vendor	jet admin
Product	jet admin cloud platform
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for jet admin jet admin cloud platform

Be the first to know when new critical vulnerabilities affecting jet admin jet admin cloud platform are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Affected Versions

Jet Admin / Jet Admin Cloud Platform

0 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

jetadmin.io: https://www.jetadmin.io/ jetadmin.io: https://www.jetadmin.io/changelog raw.githubusercontent.com: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-317-01.json cve.org: https://www.cve.org/CVERecord?id=CVE-2026-123965

Credits

Mahmoud Elkhaligy