Live › vulnerability › CVE-2026-120461
Jpom through 2.11.12 does not filter command templates and SSH nodes by workspace in its batch SSH command endpoint. A logged-in user with SSH command rights in one workspace can supply IDs from another workspace and run commands on that workspace's SSH hosts using their stored credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams running Jpom 2.11.12 or earlier with several workspaces that hold SSH nodes and stored credentials. The risk needs an account that has SSH command execute permission in at least one workspace. Single-workspace installs and users without that permission are not exposed through this path.
No product ranges from the sources yet.
through 2.11.122.11.12; the patched version is not stated in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-120461")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.