{"id":"CVE-2026-120460","published":"2026-11-02T15:17:30.053","lastModified":"2026-11-02T18:18:52.267","description":"Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51","tags":[]},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51","tags":[]},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","tags":[]},{"url":"https://github.com/dromara/Jpom/issues/119","tags":[]},{"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers","tags":[]}],"exploitRefs":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51","tags":[]},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51","tags":[]},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","tags":[]},{"url":"https://github.com/dromara/Jpom/issues/119","tags":[]}],"hasPoc":true,"ai":{"summary":"Jpom through 2.11.12 allows authenticated users to bypass workspace isolation by supplying Docker asset IDs from other workspaces, gaining unauthorized control over foreign Docker resources including containers, images, and privileged host mounts.","exploitability":"Exploitation requires only valid authentication and Docker permissions in any single workspace; no additional privileges or complex conditions are needed.","blast_radius":"A compromised user with Docker access in one workspace can fully compromise Docker hosts across all workspaces, including deploying privileged containers with host filesystem and network access.","remediation":"Upgrade to Jpom version 2.11.13 or later, which patches the cross-workspace authorization bypass.","detection":"Look for API requests to Docker management endpoints (e.g., /api/docker/*) where the workspace context does not match the asset ID's ownership in audit logs; specifically, monitor for foreign asset IDs used within a workspace’s Docker operations.","tags":["auth-bypass","docker","privilege-escalation","container-security","multi-tenancy"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:58:28.323Z"}}