{"id":"CVE-2026-120461","published":"2026-11-02T15:17:30.247","lastModified":"2026-11-02T16:17:33.673","description":"Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can supply foreign template and node IDs to run commands on other workspaces' SSH hosts using their stored credentials.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184","tags":[]},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169","tags":[]},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","tags":[]},{"url":"https://github.com/dromara/Jpom/issues/120","tags":[]},{"url":"https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-node-ssh-command-batch","tags":[]}],"exploitRefs":[{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/ssh/CommandInfoController.java#L176-L184","tags":[]},{"url":"https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/service/node/ssh/SshCommandService.java#L167-L169","tags":[]},{"url":"https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28","tags":[]},{"url":"https://github.com/dromara/Jpom/issues/120","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated user with SSH command execution rights in one workspace can bypass workspace isolation by supplying foreign template and node IDs to execute commands on SSH hosts in other workspaces using their stored credentials.","exploitability":"Low effort for an authenticated attacker with valid credentials and SSH command execute permissions in at least one workspace; no special tools required.","blast_radius":"An attacker can compromise any SSH host in any workspace accessible to the compromised account, potentially leading to full system compromise across multiple isolated environments using stored credentials.","remediation":"Upgrade to Jpom version 2.11.13 or later, which enforces workspace-level filtering on template and node ID resolution for the /node/ssh_command/batch endpoint.","detection":"Monitor for POST requests to /node/ssh_command/batch where the referenced SSH template or node IDs originate from a different workspace than the authenticated user's current context; log the user, target IDs, and workspace mismatch.","tags":["auth-bypass","cross-workspace","ssh","credential-theft","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:58:38.961Z"}}