Jpom SSH command batch flaw lets users run commands in other workspaces

Summary

The batch command feature in the Jpom server management tool does not check workspaces. A logged-in user with permission can run commands on SSH hosts in other workspaces using their stored credentials.

Affected when

• Jpom 2.11.12 and older
• authenticated user with SSH command execute permission in one workspace

What to do

Check that Jpom is newer than 2.11.12 and read the vendor's security advisory. No fixed version number is named in the sources.

Products and platforms

• Jpom

CVE IDs

• CVE-2026-120461 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-02 14:29 UTC

First seen 2026-11-09 14:10 UTC