{"id":"CVE-2026-120460","kind":"vulnerability","aliases":["CVE-2026-120460"],"related":[],"title":"Jpom: cross-workspace bypass lets users control other workspaces' Docker hosts","description":"Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.","summary":"Jpom, a server management tool, fails to check workspace ownership when a Docker asset id is supplied, so any user with Docker permission can act on other workspaces' Docker hosts. An attacker can control containers, images, volumes and networks, including starting privileged containers with host bind mounts.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","infrastructure","jpom","self-hosted"],"not_affected_if":["no-docker-management","single-workspace"],"how_to_check":"- Check the installed Jpom version (`2.11.12` or earlier is affected per the sources)\n- Review which users hold Docker permission in any workspace","fix":"- Move to a Jpom release newer than `2.11.12` (the sources do not name the exact fixed version; see the linked patch)","status":"open","published_at":"2026-11-02T15:17:30+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:25:48+00:00","updated_at":"2026-11-02T15:25:48+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-02T15:25:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Jpom release newer than `2.11.12` (the sources do not name the exact fixed version; see the linked patch)","reach":"network","title":"Jpom: cross-workspace bypass lets users control other workspaces' Docker hosts","impact":"high","summary":"Jpom, a server management tool, fails to check workspace ownership when a Docker asset id is supplied, so any user with Docker permission can act on other workspaces' Docker hosts. An attacker can control containers, images, volumes and networks, including starting privileged containers with host bind mounts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["jpom","docker","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains host-level control through privileged containers with host mounts","analyst_note":"Confirm the first fixed Jpom version from the GitHub patch link and the vulncheck advisory.","how_to_check":"- Check the installed Jpom version (`2.11.12` or earlier is affected per the sources)\n- Review which users hold Docker permission in any workspace\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-workspace","no-docker-management"],"who_is_affected":"Teams running Jpom through 2.11.12 with multiple workspaces where some users hold Docker permission. Single-workspace deployments and installs without Docker management features are less exposed. unknown for finer conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000696,"input_tokens":4177,"output_tokens":556,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120460':15A,18A '-2026':14A,17A '2.11.12':74C 'act':49B 'allow':84C 'asset':38B,97C 'attack':56B,99C 'authent':85C 'author':80C 'bind':70B,119C 'bypass':5A,81C 'check':32B 'contain':59B,67B,75C,108C,116C 'control':8A,58B,107C 'creat':114C 'cross':3A,78C 'cross-workspac':2A,77C 'cve':13A,16A 'docker':11A,19B,37B,46B,53B,91C,96C,101C 'fail':30B 'foreign':95C 'host':12A,24B,54B,69B,92C,118C 'id':39B,98C 'imag':60B,109C 'includ':64B,113C 'infrastructur':20B 'jpom':1A,21B,25B,72C 'let':6A 'manag':28B,88C 'mount':71B,120C 'network':63B,112C 'ownership':34B 'permiss':47B,102C 'privileg':66B,115C 'self':23B 'self-host':22B 'server':27B 'start':65B 'suppli':41B,94C 'tool':29B 'user':7A,44B,86C 'volum':61B,110C 'vulner':82C 'workspac':4A,10A,33B,52B,79C,90C,105C","nicknames":[],"mitigations":[],"who_affected":"Teams running Jpom through 2.11.12 with multiple workspaces where some users hold Docker permission. Single-workspace deployments and installs without Docker management features are less exposed. unknown for finer conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","high","infrastructure","jpom","selfhosted"],"first_public_at":"2026-11-02T15:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120460","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120460","severity":null,"published_at":"2026-11-02T15:17:30+00:00","modified_at":"2026-11-02T15:17:30+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52517,"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52518,"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}