Skip to content

Commit 6f50725

Browse files
shouzhiyuxianshouzhiyuxian
authored
Merge pull request #830 from jumpserver/pr@v4.0@vul_fix_JS-2026.7.29
perf: add JS-2026.7.29 inform
2 parents 404efb3 + 3374f9b commit 6f50725

2 files changed

Lines changed: 61 additions & 33 deletions

File tree

‎docs/index.en.md‎

Lines changed: 29 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,34 @@
11
# Product Introduction
22

3-
??? warning "Important Notice | JumpServer Vulnerability Notification and Fix 2025-10-30 (CVE-2025-62712|CVE-2025-62795)"
4-
**In October 2025, users reported security vulnerabilities in JumpServer open source bastion machine and reported them to the JumpServer open source project team.**
5-
6-
**Vulnerability Information：**
7-
<br>1. [JumpServer token list for connected sessions has privilege escalation risk, CVE number CVE-2025-62712](https://nvd.nist.gov/vuln/detail/CVE-2025-62712)
8-
<br>2. [JumpServer LDAP configuration has unauthorized testing risk, CVE number CVE-2025-62795](https://nvd.nist.gov/vuln/detail/CVE-2025-62795)
9-
10-
**Affected versions:** <br> JumpServer V3: <=v3.10.20 LTS
11-
<br> JumpServer V4: <=v4.10.11 LTS
12-
13-
**Secure versions:** <br> JumpServer V3: >=v3.10.21 LTS
14-
<br> JumpServer V4: >=v4.10.12 LTS
15-
16-
**Fix solutions:**
17-
<br>**Permanent fix:** Upgrade JumpServer software to the above secure versions.
18-
<br>**Temporary fix:** Restrict access to relevant API endpoints with minimal impact to main JumpServer functions. **Nginx configuration example:**
19-
20-
```nginx
21-
# CVE-2025-62712
22-
location /api/v1/authentication/super-connection-token/ {
23-
return 200 '';
24-
}
25-
location /api/v1/resources/super-connection-tokens/ {
26-
return 200 '';
27-
}
28-
29-
# CVE-2025-62795, this will disable test and import functions in ldap config
30-
location /ws/ldap {
31-
return 200 '';
32-
}
33-
34-
```
35-
**Special thanks to:** <br> Thanks to SolidLab for discovering and timely reporting the above vulnerabilities to the JumpServer open source community.
3+
??? warning "[Important Notice | JumpServer Vulnerability Notification and Remediation (JS-2026.7.29)]"
4+
In July 2026, the JumpServer open source project team received vulnerability reports from security researchers. After verification, the following vulnerabilities were confirmed:
5+
6+
■ **Vulnerability in the fastjson dependency of the JumpServer Chen component (CVE-2026-16723)**. Details: [Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)
7+
8+
■ **SFTP path traversal in JumpServer KoKo Web Terminal (CVE-2026-54336)**. Details: [GHSA-x6rg-36j6-76vr](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr)
9+
10+
■ **Remote command execution through Jinja template injection during JumpServer Applet Host deployment (CVE-2026-44845)**. Details: [GHSA-22h6-pcgh-9v7q](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q)
11+
12+
■ **Privilege overwrite in JumpServer organization invitation logic (CVE-2026-44846)**. Details: [GHSA-j836-99w5-523r](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r)
13+
14+
**Affected versions:**
15+
16+
<br>JumpServer V3: earlier than v3.10.22 LTS
17+
<br>JumpServer V4: earlier than v4.10.17 LTS
18+
19+
**Secure versions:**
20+
21+
<br>JumpServer V3: v3.10.22 LTS or later
22+
<br>JumpServer V4: v4.10.17 LTS or later
23+
24+
If an immediate upgrade is not possible:
25+
26+
**■** Restrict administrative access to high-risk functionality such as Ansible automation, SSH gateways, and Applet Hosts, granting the relevant permissions only to trusted administrators;
27+
28+
**■** Review existing SSH gateway configurations, automation task templates, Applet Host configurations, and organization role change records for suspicious content;
29+
30+
**■** Limit the use of accounts that have user invitation permissions.
31+
3632

3733

3834
## 1 What is JumpServer?

‎docs/index.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,37 @@
11
# 产品介绍
22

3+
??? warning "[重要通知丨JumpServer 漏洞通知及修复方案（JS-2026.7.29）]"
4+
5+
2026 年 7 月，JumpServer 开源项目组收到安全研究人员提交的漏洞报告。经验证，此次发现的漏洞包括：
6+
7+
■ **JumpServer Chen 组件依赖库 fastjson 漏洞（CVE-2026-16723）**。漏洞详情：[Security Advisory: Remote Code Execution in fastjson 1.2.68-1.2.83](https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83)
8+
9+
■ **JumpServer KoKo Web Terminal SFTP 路径遍历漏洞（CVE-2026-54336）**。漏洞详情：[GHSA-x6rg-36j6-76vr](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr)
10+
11+
■ **JumpServer Applet Host 部署 Jinja 模板注入远程命令执行漏洞（CVE-2026-44845）**。漏洞详情：[GHSA-22h6-pcgh-9v7q](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q)
12+
13+
■ **JumpServer 组织邀请逻辑权限覆盖漏洞（CVE-2026-44846）**。漏洞详情：[GHSA-j836-99w5-523r](https://github.com/jumpserver/jumpserver/security/advisories/GHSA-j836-99w5-523r)
14+
15+
**以上漏洞影响版本：**
16+
17+
<br>JumpServer V3 版本：&lt; v3.10.22 LTS 版本
18+
<br>JumpServer V4 版本：&lt; v4.10.17 LTS 版本
19+
20+
**安全版本：**
21+
22+
<br>JumpServer V3 版本：>= v3.10.22 LTS 版本
23+
<br>JumpServer V4 版本：>= v4.10.17 LTS 版本
24+
25+
26+
如果暂时无法升级：
27+
28+
**■** 建议限制 Ansible 自动化、SSH 网关、Applet Host 等高风险功能的管理权限，仅向可信管理员授予相关权限；
29+
30+
**■** 审查已有 SSH 网关配置、自动化任务模板、Applet Host 配置以及组织角色变更记录，排查异常内容；
31+
32+
**■** 限制具有用户邀请权限账号的使用范围。
33+
34+
335
!!! tip "[信创合规、开箱即用、全栈优化丨飞致云联合宏时数据发布 Zabbix 信创一体机！](https://fit2cloud.com/zabbix/index.html)"
436

537
## 1 JumpServer 是什么？

0 commit comments

Comments
 (0)