Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M

CVE-2025-27095JumpServer has a Kubernetes Token Leak Vulnerability

Medium 4.3

In plain English

A medium-severity security flaw in jumpserver from jumpserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server controlled by the attacker. This allows the attacker to intercept and capture the Kubernetes cluster token. This can potentially allow unauthorized access to the cluster and compromise its security. This vulnerability is fixed in 4.8.0 and 3.10.18.

Affected products (as reported)

Vendor	Product	Versions
jumpserver	jumpserver	< 3.10.18>= 4.0.0, < 4.8.0

Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-5q9w-f4wh-f535 x_refsource_CONFIRM