---
id: "CVE-2026-120461"
kind: "vulnerability"
aliases: ["CVE-2026-120461"]
title: "Jpom: authenticated users can run SSH commands on other workspaces' hosts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jpom", "package", "self-hosted", "ssh"]
not_affected_if: ["no-ssh-command-permission", "single-workspace"]
published_at: "2026-11-02T15:17:30+00:00"
first_seen_at: "2026-11-02T15:24:04+00:00"
updated_at: "2026-11-02T15:25:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120461", "first_seen_at": "2026-11-02T15:24:04+00:00"}]
---

# Jpom: authenticated users can run SSH commands on other workspaces' hosts

Jpom through 2.11.12 does not filter command templates and SSH nodes by workspace in its batch SSH command endpoint. A logged-in user with SSH command rights in one workspace can supply IDs from another workspace and run commands on that workspace's SSH hosts using their stored credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jpom version against the range `through 2.11.12`
- Review who holds SSH command execute permission across workspaces

## Fix

- Move past `2.11.12`; the patched version is not stated in the sources

## Timeline

- 2026-11-02T15:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120461

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch
- [fix] Patch: github.com https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28

## From the sources

Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_