CVE-2021-3169

CRITICAL 9.8CVE-2021-3169 · Published 23/07/2021 · updated 17/06/2026

In short

CVE-2021-3169 is a CRITICAL (CVSS 9.8) vulnerability affecting jumpserver (jumpserver).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
Fix: update to 2.4.5, 2.5.4, 2.6.2 or later.

Package	Affected versions	Patched versions
jumpserver jumpserver	`≥ 2.4.0, < 2.4.5≥ 2.5.0, < 2.5.4≥ 2.6.0, < 2.6.2`	`2.4.52.5.42.6.2`

Description

An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.

References

blog.fit2cloud.com · Third Party Advisory
mp.weixin.qq.com/s/5tgcaIrnDnGP-LvWPw9YCg · Third Party Advisory
s.tencent.com/research/bsafe/1228.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free