CVE-2026-120460

Summary

Jpom through 2.11.12 allows authenticated users to bypass workspace isolation by supplying Docker asset IDs from other workspaces, gaining unauthorized control over foreign Docker resources including containers, images, and privileged host mounts.

Exploitability

Exploitation requires only valid authentication and Docker permissions in any single workspace; no additional privileges or complex conditions are needed.

Blast radius

A compromised user with Docker access in one workspace can fully compromise Docker hosts across all workspaces, including deploying privileged containers with host filesystem and network access.

Detection

Look for API requests to Docker management endpoints (e.g., /api/docker/*) where the workspace context does not match the asset ID's ownership in audit logs; specifically, monitor for foreign asset IDs used within a workspace’s Docker operations.

Prioritized remediation

Upgrade to Jpom version 2.11.13 or later, which patches the cross-workspace authorization bypass.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.