{"id":"CVE-2026-120461","kind":"vulnerability","aliases":["CVE-2026-120461"],"related":[],"title":"Jpom: authenticated users can run SSH commands on other workspaces' hosts","description":"Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.","summary":"Jpom through 2.11.12 does not filter command templates and SSH nodes by workspace in its batch SSH command endpoint. A logged-in user with SSH command rights in one workspace can supply IDs from another workspace and run commands on that workspace's SSH hosts using their stored credentials.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jpom","package","self-hosted","ssh"],"not_affected_if":["no-ssh-command-permission","single-workspace"],"how_to_check":"- Check the installed Jpom version against the range `through 2.11.12`\n- Review who holds SSH command execute permission across workspaces","fix":"- Move past `2.11.12`; the patched version is not stated in the sources","status":"open","published_at":"2026-11-02T15:17:30+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:25:44+00:00","updated_at":"2026-11-02T15:25:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:25:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move past `2.11.12`; the patched version is not stated in the sources\n- unknown for any other step","reach":"network","title":"Jpom: authenticated users can run SSH commands on other workspaces' hosts","impact":"high","summary":"Jpom through 2.11.12 does not filter command templates and SSH nodes by workspace in its batch SSH command endpoint. A logged-in user with SSH command rights in one workspace can supply IDs from another workspace and run commands on that workspace's SSH hosts using their stored credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["jpom","self-hosted","ssh"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Commands run on other workspaces' SSH hosts using their stored credentials","analyst_note":"Confirm the patched Jpom version from the linked Patch page on github.com and the exact fix range from the vulncheck advisory.","how_to_check":"- Check the installed Jpom version against the range `through 2.11.12`\n- Review who holds SSH command execute permission across workspaces\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["single-workspace","no-ssh-command-permission"],"who_is_affected":"Teams running Jpom 2.11.12 or earlier with several workspaces that hold SSH nodes and stored credentials. The risk needs an account that has SSH command execute permission in at least one workspace. Single-workspace installs and users without that permission are not exposed through this path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000707,"input_tokens":4190,"output_tokens":576,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120461':14A,17A '-2026':13A,16A '/node/ssh_command/batch':86C '2.11.12':26B,76C 'anoth':59B 'authent':2A,99C 'author':82C 'batch':39B 'bypass':83C 'command':7A,30B,41B,50B,63B,89C,103C,118C 'contain':77C 'credenti':73B,127C 'cross':80C 'cross-workspac':79C 'cve':12A,15A 'endpoint':42B 'execut':104C 'filter':29B,98C 'foreign':111C 'host':11A,22B,69B,123C 'id':57B,95C,115C 'jpom':1A,18B,24B,74C 'log':45B 'logged-in':44B 'node':34B,93C,114C 'one':53B,107C 'packag':19B 'permiss':105C 'post':85C 'resolv':88C 'right':51B 'run':5A,62B,117C 'self':21B 'self-host':20B 'ssh':6A,23B,33B,40B,49B,68B,92C,102C,122C 'store':72B,126C 'suppli':56B,110C 'templat':31B,90C,112C 'use':70B,124C 'user':3A,47B,100C 'without':96C 'workspac':10A,36B,54B,60B,66B,81C,97C,108C,121C","nicknames":[],"mitigations":[],"who_affected":"Teams running Jpom 2.11.12 or earlier with several workspaces that hold SSH nodes and stored credentials. The risk needs an account that has SSH command execute permission in at least one workspace. Single-workspace installs and users without that permission are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jpom","package","selfhosted","ssh"],"first_public_at":"2026-11-02T15:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120461","severity":null,"published_at":"2026-11-02T15:17:30+00:00","modified_at":"2026-11-02T15:17:30+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52517,"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52520,"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}