CVE-2026-44845

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17

Description An authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or the Core Service Address field. This allows Ansible to evaluate ansible host inventory data or playbook variables during Applet Host deployment, leading to arbitrary command execution on the JumpServer control node. Jinja2 is a templating engine for Python used to generate dynamic content.

Recommendations Update to version 4.10.17.