CVE-2026-44845
JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment
CVSS Score
6.7
EPSS Score
0.0%
EPSS Percentile
0th
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment and execute arbitrary commands on the JumpServer control node. This issue is fixed in version 4.10.17.
| CWE | CWE-1336 |
| Vendor | jumpserver |
| Product | jumpserver |
| Published | Aug 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for jumpserver jumpserver
Be the first to know when new medium vulnerabilities affecting jumpserver jumpserver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High
Affected Versions
jumpserver / jumpserver
< 4.10.17
References
github.com: https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q github.com: https://github.com/jumpserver/jumpserver/pull/16749 github.com: https://github.com/jumpserver/jumpserver/pull/16886 github.com: https://github.com/jumpserver/jumpserver/commit/cc57ba0de5f6015746fae11cfc62402b11618e59 github.com: https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17