CVE-2026-104126

Deferred Deferred - Pending Action

Ansible Template Injection in JumpServer

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation tasks. Crafted content can invoke sensitive Ansible lookup behavior, including file, pipe, env, and password lookups, within the Ansible execution context, which can disclose files or environment values and may permit limited command execution under the privileges of the automation process. The issue does not provide unauthenticated access or direct access to unrelated JumpServer assets. This issue is fixed in version 4.10.17-lts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104126

EUVD

EUVD-2026-98923

Affected Vendors & Products

Vendor	Product	Version / Range
jumpserver	jumpserver	< 4.10.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in JumpServer allows authenticated users with permission to create or execute Ansible-based automation tasks to exploit template rendering. Attackers can inject malicious template expressions that trigger unsafe Ansible lookup plugins like file, pipe, env, or password. This may lead to information disclosure or limited command execution within the Ansible execution context.

Detection Guidance

Detecting this vulnerability requires checking JumpServer versions and reviewing automation task configurations. Verify if your JumpServer version is below 4.10.17-lts using: curl -s https://<jumpserver-url>/api/v1/about/ | grep version. Inspect Ansible automation tasks for suspicious template expressions or unsafe lookup plugins in task definitions.

Impact Analysis

An attacker with sufficient permissions could access sensitive files, environment variables, or limited command execution under the privileges of the automation process. This requires authenticated access and specific permissions, so it does not allow unauthenticated access or direct access to unrelated JumpServer assets.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as files or environment variables, potentially violating GDPR or HIPAA compliance if such data includes personal or health information. Organizations using JumpServer should upgrade to version 4.10.17-lts or later to mitigate this risk.

Mitigation Strategies

Upgrade JumpServer to version 4.10.17-lts or later immediately. If upgrading is not possible, restrict access to Ansible-based automation features and disable unsafe Ansible lookup plugins manually in template rendering configurations.

Hi! I’m here to help you understand CVE-2026-104126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70