Live › vulnerability › CVE-2026-111605
Go to dashboardJpom through 2.11.12 has an authorization bypass in its SshFileController: an authenticated user can supply SSH asset ids belonging to other workspaces. That lets them read, upload, modify, rename and delete files on those foreign SSH hosts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Jpom 2.11.12 or earlier that use multiple workspaces and have SSH hosts managed through the SSH file features. Exposure requires a user with SSH file permissions in any workspace, so single-workspace deployments with trusted users are at lower risk.
No product ranges from the sources yet.
2.11.12 or earlier.2.11.12; the sources do not name the fixed release, so check the vendor release notes.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
This page as .md · .json · in your agent: get_signal("CVE-2026-111605")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.