CVE-2023-28110

Name: CVE-2023-28110
Creator: NVD / NIST
Published: 2023-03-16T17:15:09.85+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.9/10EPSS 0.85%

Last modified Jun 17, 2026

CVE-2023-28110 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. EPSS estimates a 0.85% chance of exploitation in the next 30 days.

Description

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and Web Terminal service. Prior to version 2.28.8, using illegal tokens to connect to a Kubernetes cluster through Koko can result in the execution of dangerous commands that may disrupt the Koko container environment and affect normal usage. The vulnerability has been fixed in v2.28.8.

Metrics

CVSS 3.1

9.9/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Probability

0.85%

53.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-77

Affected Software

Vendor	Product	Versions
Fit2cloud	Jumpserver	< 2.28.8
Fit2cloud	Koko	All versions

References

https://github.com/jumpserver/jumpserver/releases/tag/v2.28.8Patch, Release Notes
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6x5p-jm59-jh29Exploit, Vendor Advisory
https://github.com/jumpserver/jumpserver/releases/tag/v2.28.8Patch, Release Notes
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-6x5p-jm59-jh29Exploit, Vendor Advisory

Timeline

Published: Mar 16, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-28110?

How severe is CVE-2023-28110?

CVE-2023-28110 has a CVSS score of 9.9/10 (CRITICAL severity). The EPSS model estimates a 0.85% probability of exploitation in the next 30 days.

How do I fix CVE-2023-28110?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-28110?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST