CVE-2026-120201
CriticalCVSS 9.8Summary
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Risk Assessment
An attacker can gain full administrative control over Jpom and execute arbitrary commands on managed hosts. This poses a serious risk to CI/CD and server management environments.
Recommendation
Upgrade Jpom beyond 2.11.12, which fixes the authentication bypass. Until then, restrict access to the Jpom interface and monitor for unusual JPOM-USER-TOKEN headers.
Other vulnerabilities in Jpom
See all- CVE-2026-111605High
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.
- CVE-2026-91993Medium
Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint. An authenticated user can access repositories from other workspaces, including enumerating repository existence, determining repository type, and executing git ls-remote commands using other workspaces' stored credentials.
Original NVD description (English source)
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS