CVE-2026-44845 jumpserver CVE debrief

Who should care

System administrators and security teams responsible for managing JumpServer instances should assess their exposure and apply the patch to prevent potential command execution on the control node.

Why it matters

CVE-2026-44845 is a vulnerability in JumpServer that allows for potential command execution on the control node. Defenders should prioritize verifying exposure and applying the patch.

• Potential command execution on the JumpServer control node.
• Elevation of privileges for authenticated administrators with Applet Host management and deployment permissions.
• Possible disruption of JumpServer operations.

Technical summary

The vulnerability in JumpServer allows an authenticated administrator with Applet Host management and deployment permissions to inject Jinja2 expressions into the IP/Host field or Core Service Address field. This can cause Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment, potentially leading to arbitrary command execution on the JumpServer control node.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for potential command execution on the control node.

Recommended defensive actions

• Verify if the current version of JumpServer is prior to 4.10.17 and update to 4.10.17 if necessary.
• Restrict Applet Host management and deployment permissions to minimize the attack surface.
• Monitor for suspicious activity on the JumpServer control node.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability in JumpServer, tracked as CVE-2026-44845, allows an authenticated administrator with Applet Host management and deployment permissions to inject Jinja2 expressions into the IP/Host field or Core Service Address field. This can cause Ansible to evaluate ansible_host inventory data or playbook variables during Applet Host deployment, potentially leading to arbitrary command execution on the JumpServer control node. The issue is fixed in version 4.10.17. Defenders should prioritize verifying exposure and applying the 4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.