CVE-2026-104126

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17-lts

Description Ansible-based automation rendering allows the evaluation of attacker-controlled template expressions by users with permissions to create or execute affected automation tasks. This can trigger sensitive Ansible lookup behaviors, such as file, pipe, env, and password lookups, within the execution context. Consequently, this may lead to the disclosure of files or environment values and allow limited command execution under the privileges of the automation process.

Recommendations Update to version 4.10.17-lts.