Ansible-based Automation Vulnerability in JumpServer by JumpServer

CVE-2026-104126

What is CVE-2026-104126?

JumpServer, an open-source bastion host and security audit system, has a vulnerability in its Ansible-based automation rendering functionality. Prior to version 4.10.17-lts, the system evaluates user-controlled template expressions from users who can create or execute automation tasks. This can lead to the invocation of sensitive Ansible lookup behaviors including file, pipe, environment, and password lookups within the execution context. As a result, it may inadvertently expose sensitive files or environment variables and possibly allow limited command execution with the privileges of the automation process. The issue does not allow for unauthenticated access and is limited to the affected automation tasks. A patch addressing this vulnerability was implemented in version 4.10.17-lts.

References