CVE-2026-112159

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Template Rendering. The manipulation of the argument IP/HOST leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 5.0.0 is sufficient to fix this issue. The identifier of the patch is fcf2904cdb884230e9676f50f37a44d09fa97040. The affected component should be upgraded. The vendor confirms: "This issue was identified quite some time ago, and we have already fixed it in the v5 branch. (...) The fix will also be included in an upcoming v4 release.

• CWE-77
• CWE-78

• https://gist.github.com/Seikruun/b628bb6d4403d9c41a54a4b92d775583
• https://github.com/jumpserver/jumpserver/
• https://github.com/jumpserver/jumpserver/commit/fcf2904cdb884230e9676f50f37a44d09fa97040
• https://github.com/jumpserver/jumpserver/pull/17500/
• https://github.com/jumpserver/jumpserver/releases/tag/v5.0.0
• https://vuldb.com/cve/CVE-2026-112159
• https://vuldb.com/submit/964676
• https://vuldb.com/vuln/422286
• https://vuldb.com/vuln/422286/cti

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112150A security flaw has been discovered in vraj404 Criminal-Mana…7.3
• CVE-2026-112151A weakness has been identified in vraj404 Criminal Managemen…7.3
• CVE-2026-112152A security vulnerability has been detected in vraj404 Crimin…7.3
• CVE-2026-112153A vulnerability was detected in vraj404 Criminal-Management-…7.3
• CVE-2026-112157A weakness has been identified in MemTensor memmy-agent up t…3.1
• CVE-2026-112158A weakness has been identified in MikroTik RouterOS up to 6.…6.5
• CVE-2026-11216Incorrect security UI in File Input in Google Chrome prior t…4.3
• CVE-2026-112161MobaXterm Personal Edition (Portable) 26.4 GA extracts the C…8.5
• CVE-2026-11217Inappropriate implementation in Fenced Frames in Google Chro…6.5
• CVE-2026-112177A flaw was found in Ghostscript as shipped with Red Hat Ente…7.3
• CVE-2026-112178MISP contains an access control flaw in the proposal (shadow…7.1
• CVE-2026-112179In MISP, the event synchronization process contained a logic…5.3