Critical severity9.9NVD Advisory· Published Mar 29, 2024· Updated Jun 17, 2026

CVE-2024-29201

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jumpserver/Jumpserverllm-fuzzy2 versions
<3.10.7+ 1 more
- (no CPE)range: <3.10.7
- (no CPE)range: >= 3.0.0, <= 3.10.6

Patches

Vulnerability mechanics

References

github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwjnvdExploitVendor Advisory
www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2nvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000