CVE-2026-120461

Summary

An authenticated user with SSH command execution rights in one workspace can bypass workspace isolation by supplying foreign template and node IDs to execute commands on SSH hosts in other workspaces using their stored credentials.

Exploitability

Low effort for an authenticated attacker with valid credentials and SSH command execute permissions in at least one workspace; no special tools required.

Blast radius

An attacker can compromise any SSH host in any workspace accessible to the compromised account, potentially leading to full system compromise across multiple isolated environments using stored credentials.

Detection

Monitor for POST requests to /node/ssh_command/batch where the referenced SSH template or node IDs originate from a different workspace than the authenticated user's current context; log the user, target IDs, and workspace mismatch.

Prioritized remediation

Upgrade to Jpom version 2.11.13 or later, which enforces workspace-level filtering on template and node ID resolution for the /node/ssh_command/batch endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.