CVE-2024-29201

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

• CWE-94
• CWE-94

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwjExploit, Vendor Advisory
• https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwjExploit, Vendor Advisory

Published

Mar 29, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29196phpMyFAQ is an open source FAQ web application for PHP 8.1+ …2.7
• CVE-2024-29197Pimcore is an Open Source Data & Experience Management Platf…6.5
• CVE-2024-29198GeoServer is an open source software server written in Java …8.2
• CVE-2024-29199Nautobot is a Network Source of Truth and Network Automation…5.3
• CVE-2024-2920The WP-Members Membership Plugin plugin for WordPress is vul…5.3
• CVE-2024-29200Kimai is a web-based multi-user time-tracking application. T…6.5
• CVE-2024-29202JumpServer is an open source bastion host and an operation a…9.9
• CVE-2024-29203TinyMCE is an open source rich text editor. A cross-site scr…6.1
• CVE-2024-29204A Heap Overflow vulnerability in WLAvalancheService componen…9.8
• CVE-2024-29205An Improper Check for Unusual or Exceptional Conditions vuln…7.5
• CVE-2024-29206An Improper Access Control could allow a malicious actor aut…2.2
• CVE-2024-29207An Improper Certificate Validation could allow a malicious a…7.5