{"id":"CVE-2026-111605","kind":"vulnerability","aliases":["CVE-2026-111605"],"related":[],"title":"Jpom: SSH file controller lets users reach other workspaces' hosts","description":"Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.","summary":"Jpom through 2.11.12 has an authorization bypass in its SshFileController: an authenticated user can supply SSH asset ids belonging to other workspaces. That lets them read, upload, modify, rename and delete files on those foreign SSH hosts.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jpom","package","self-hosted","ssh"],"not_affected_if":["no-ssh-file-features","single-workspace"],"how_to_check":"- Check the installed Jpom version and see whether it is `2.11.12` or earlier.\n- Confirm whether SSH file management is in use by looking for SSH hosts registered across multiple workspaces.","fix":"- Upgrade Jpom to a version newer than `2.11.12`; the sources do not name the fixed release, so check the vendor release notes.\n- Until patched, restrict SSH file permissions to trusted users only.","status":"open","published_at":"2026-10-16T18:17:39+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:00:09+00:00","updated_at":"2026-10-25T03:00:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:00:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jpom to a version newer than `2.11.12`; the sources do not name the fixed release, so check the vendor release notes.\n- Until patched, restrict SSH file permissions to trusted users only.","reach":"network","title":"Jpom: SSH file controller lets users reach other workspaces' hosts","impact":"high","summary":"Jpom through 2.11.12 has an authorization bypass in its SshFileController: an authenticated user can supply SSH asset ids belonging to other workspaces. That lets them read, upload, modify, rename and delete files on those foreign SSH hosts.","category":"package","nicknames":[],"who_cares":["jpom","self-hosted","ssh","java"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads, modifies or deletes files on other workspaces' SSH hosts","analyst_note":"Find the fixed Jpom version and vendor advisory; the NVD entry alone does not name a patched release.","how_to_check":"- Check the installed Jpom version and see whether it is `2.11.12` or earlier.\n- Confirm whether SSH file management is in use by looking for SSH hosts registered across multiple workspaces.","needs_analyst":true,"not_affected_if":["single-workspace","no-ssh-file-features"],"who_is_affected":"Teams running Jpom 2.11.12 or earlier that use multiple workspaces and have SSH hosts managed through the SSH file features. Exposure requires a user with SSH file permissions in any workspace, so single-workspace deployments with trusted users are at lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":3379,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111605':13A,16A '-2026':12A,15A '2.11.12':26B,63C 'access':77C 'allow':72C 'asset':40B,88C 'attack':90C 'authent':35B,73C 'author':29B,66C 'belong':42B,80C 'bypass':30B,67C 'call':99C 'contain':64C 'control':4A 'cve':11A,14A 'delet':54B,113C 'delete.json':104C 'download':100C 'endpoint':108C 'file':3A,55B,93C,114C 'foreign':58B,86C 'host':10A,22B,60B,79C,119C 'id':41B,89C 'java':17B 'jpom':1A,18B,24B,61C 'let':5A,47B 'modifi':51B,111C 'new_file_folder.json':107C 'packag':19B 'permiss':94C 'reach':7A 'read':49B,110C 'read_file_data.json':102C 'renam':52B 'rename.json':105C 'self':21B 'self-host':20B 'ssh':2A,23B,39B,59B,78C,87C,92C,118C 'sshfilecontrol':33B,70C 'suppli':38B,85C 'update_file_data.json':103C 'upload':50B,101C 'user':6A,36B,75C 'vulner':68C 'workspac':9A,45B,74C,83C,97C,117C","nicknames":[],"mitigations":[],"who_affected":"Teams running Jpom 2.11.12 or earlier that use multiple workspaces and have SSH hosts managed through the SSH file features. Exposure requires a user with SSH file permissions in any workspace, so single-workspace deployments with trusted users are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111605","severity":null,"published_at":"2026-10-16T18:17:39+00:00","modified_at":"2026-10-19T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}