Live › vulnerability › CVE-2026-120460
Jpom, a server management tool, fails to check workspace ownership when a Docker asset id is supplied, so any user with Docker permission can act on other workspaces' Docker hosts. An attacker can control containers, images, volumes and networks, including starting privileged containers with host bind mounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams running Jpom through 2.11.12 with multiple workspaces where some users hold Docker permission. Single-workspace deployments and installs without Docker management features are less exposed. unknown for finer conditions.
No product ranges from the sources yet.
2.11.12 or earlier is affected per the sources)2.11.12 (the sources do not name the exact fixed version; see the linked patch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-120460")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.