CVE-2023-42818

JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-287
• CWE-307

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jvExploit, Vendor Advisory
• https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jvExploit, Vendor Advisory

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42812Galaxy is an open-source platform for FAIR data analysis. Pr…4.3
• CVE-2023-42813Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42814Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42815Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42816Kyverno is a policy engine designed for Kubernetes. A securi…5.3
• CVE-2023-42817Pimcore admin-ui-classic-bundle provides a Backend UI for Pi…5.4
• CVE-2023-42819JumpServer is an open source bastion host. Logged-in users c…8.8
• CVE-2023-4282The EmbedPress plugin for WordPress is vulnerable to unautho…4.3
• CVE-2023-42820JumpServer is an open source bastion host. This vulnerabilit…8.2
• CVE-2023-42821The package `github.com/gomarkdown/markdown` is a Go library…7.5
• CVE-2023-42822xrdp is an open source remote desktop protocol server. Acces…6.5
• CVE-2023-42823The issue was resolved by sanitizing logging This issue is f…5.5