Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-44845JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

Medium 6.7

In plain English

A medium-severity security flaw in jumpserver from jumpserver. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment and execute arbitrary commands on the JumpServer control node. This issue is fixed in version 4.10.17.

Affected products (as reported)

Vendor	Product	Versions
jumpserver	jumpserver	< 4.10.17

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H

References

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-22h6-pcgh-9v7q x_refsource_CONFIRM
https://github.com/jumpserver/jumpserver/pull/16749 x_refsource_MISC
https://github.com/jumpserver/jumpserver/pull/16886 x_refsource_MISC
https://github.com/jumpserver/jumpserver/commit/cc57ba0de5f6015746fae11cfc62402b11618e59 x_refsource_MISC
https://github.com/jumpserver/jumpserver/releases/tag/v4.10.17 x_refsource_MISC