---
id: "CVE-2026-120460"
kind: "vulnerability"
aliases: ["CVE-2026-120460"]
title: "Jpom: cross-workspace bypass lets users control other workspaces' Docker hosts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["docker", "infrastructure", "jpom", "self-hosted"]
not_affected_if: ["no-docker-management", "single-workspace"]
published_at: "2026-11-02T15:17:30+00:00"
first_seen_at: "2026-11-02T15:24:04+00:00"
updated_at: "2026-11-02T15:25:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120460", "first_seen_at": "2026-11-02T15:24:04+00:00"}]
---

# Jpom: cross-workspace bypass lets users control other workspaces' Docker hosts

Jpom, a server management tool, fails to check workspace ownership when a Docker asset id is supplied, so any user with Docker permission can act on other workspaces' Docker hosts. An attacker can control containers, images, volumes and networks, including starting privileged containers with host bind mounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jpom version (`2.11.12` or earlier is affected per the sources)
- Review which users hold Docker permission in any workspace

## Fix

- Move to a Jpom release newer than `2.11.12` (the sources do not name the exact fixed version; see the linked patch)

## Timeline

- 2026-11-02T15:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120460

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers
- [fix] Patch: github.com https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28

## From the sources

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_