CVE-2026-120460— Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

Quick assessment

Affected

dromara Jpom

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jpom 在 2.11.12 版本之前存在跨工作区授权绕过漏洞，允许已认证用户通过提供其他工作区的 Docker 资产 ID 来管理其他工作区的 Docker 主机。任何拥有 Docker 权限的攻击者均可控制容器、镜像、卷和网络，包括创建具有主机绑定挂载的特权容器。

CVSS 8.8 · High Updated Nov 03, 2026

Possible ATT&CK Techniques 3 AI

T1015 T1055.004 · Asynchronous Procedure Call T1068.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

Source: CVE Program / CVE List V5

Vulnerability Description

Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control containers, images, volumes and networks, including creating privileged containers with host bind mounts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
dromara	Jpom	0 ~ 2.11.12	-

II. Public POCs for CVE-2026-120460

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120460

请登录查看更多情报信息。

Other References for CVE-2026-120460 (5)

https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerImagesController.java#L48-L51 technical-description
https://github.com/dromara/Jpom/commit/ff09fe8095a792cea9c4b8babd93a333655d0a28 patch
https://github.com/dromara/Jpom/blob/v2.11.12/modules/server/src/main/java/org/dromara/jpom/controller/docker/DockerContainerController.java#L48-L51 technical-description
https://github.com/dromara/Jpom/issues/119 issue-tracking
https://www.vulncheck.com/advisories/jpom-through-2.11.12-cross-workspace-authorization-bypass-via-docker-controllers third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120460

IV. Related Vulnerabilities

Same product: Jpom

Same vendor: dromara

Same weakness: CWE-639