Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120201updated 31 Oct 2026, 18:33 UTC

Jpom lets anyone without a login become a super admin

Jpom is a web tool for managing servers. A crafted request header can trick it into granting full admin rights to anyone, with no password needed. From there, attackers can run commands on the server.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerSends crafted request without credentials
  2. 2Malicious token headerJPOM-USER-TOKEN contains 'is not null'
  3. 3Condition parser runsHutool treats the text as an operator
  4. 4Super-admin grantedAuthentication check is bypassed
  5. 5Commands executedAttacker uses script features on host
  6. ResultAttacker controls the Jpom server

What happened

Jpom 2.10.0 through 2.11.12 has an authentication bypass: query-condition text injected into the JPOM-USER-TOKEN header is parsed by Hutool's Condition parser as an operator (e.g., 'is not null'), granting super-administrator access to unauthenticated attackers, who can then execute commands via Jpom's script features.

Why it is dangerous: An attacker on the network can take full control of the Jpom host and run arbitrary commands, which can expose or change everything it manages.

Are you affected?

You are affected if you run Jpom version 2.10.0 through 2.11.12.

Jpom 2.10.0 through 2.11.12

What to do

  1. Check whether your Jpom version is between 2.10.0 and 2.11.12.
  2. Restrict network access to the Jpom web interface to trusted users only until a fix is confirmed.
  3. Watch the GitHub advisory GHSA-mr28-xw2h-9rw4 for an official patched version and update as soon as one is released.

Timeline

  1. 31 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 31 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 31 Oct 2026, 18:20 UTC
    Picked up by Zero Radar
  4. 31 Oct 2026, 18:33 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120201 · GHSA-mr28-xw2h-9rw4
CVSS
9.3 / 10
Disclosed
31 Oct 2026, 18:17 UTC
On Zero Radar
31 Oct 2026, 18:20 UTC (4 min after disclosure)
Last change
31 Oct 2026, 18:33 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Jpom lets anyone without a login become a super admin · Zero Radar