Jpom Authentication Bypass and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-120201)
Executive & SecOps Summary
SECOPS ASSESSMENTJpom versions 2.10.0 through 2.11.12
Unauthenticated remote attackers can bypass authentication to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header, leading to arbitrary command execution via script features
Immediately upgrade Jpom to the patched version (2.11.13 or later) and restrict external access to the management console
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Jpom instance to version 2.11.13 or later immediately. Below are the commands to update Jpom in a Docker-based environment.
# Pull the latest secure Jpom server image
docker pull dromara/jpom-server:latest
# Stop and remove the vulnerable container
docker stop jpom-server
docker rm jpom-server
# Run the new container with existing data volumes preserved
docker run -d -p 2122:2122 --name jpom-server -v /home/jpom/data:/usr/local/jpom-server/data dromara/jpom-server:latest2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, deploy a reverse proxy (e.g., Nginx) to inspect and block malicious patterns in the JPOM-USER-TOKEN header, and restrict access to the Jpom console to trusted IP addresses.
# Nginx configuration to block malicious header injection
server {
listen 80;
server_name jpom.local;
location / {
# Block requests containing 'is not null' in the JPOM-USER-TOKEN header
if ($http_jpom_user_token ~* 'is\\s+not\\s+null') {
return 403 'Access Denied: Malicious Header Detected';
}
proxy_pass http://127.0.0.1:2122;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}3. Log Audit & IoC Verification Commands
Use the following commands to scan Jpom access logs for potential exploitation attempts and verify the currently running version of Jpom.
# Scan Jpom logs for malicious 'is not null' token injection attempts
grep -ri 'JPOM-USER-TOKEN' /home/jpom/logs/ 2>/dev/null | grep -Ei 'is[[:space:]]+not[[:space:]]+null'
# Verify the running Jpom server version
ps -ef | grep jpom | grep -oE 'jpom-server-[0-9.]+'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical authentication bypass and remote code execution (RCE) flaw in Jpom, an open-source project management platform. The root cause lies within the LoginInterceptor class, which processes user sessions and validates tokens supplied via the JPOM-USER-TOKEN HTTP request header. When parsing this header, Jpom utilizes the Hutool library's Condition parser. Due to insufficient input validation, the parser treats specific query-like strings (such as 'is not null') as logical operators rather than literal values. This manipulates the underlying database query to evaluate to true, effectively bypassing the authentication mechanism and granting the attacker super-administrator privileges.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a crafted HTTP request to the Jpom server with the header JPOM-USER-TOKEN: is not null. When Jpom processes this request, the Hutool Condition parser interprets the injected value as a query operator. This alters the database lookup logic, causing the query to return a valid administrator session regardless of the token's actual validity. Once authenticated as a super-administrator, the attacker can leverage Jpom's built-in node management and script execution features to run arbitrary system commands on the host operating system.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk to organizations utilizing Jpom. Successful exploitation allows complete compromise of the Jpom server and all managed nodes. Attackers can exfiltrate sensitive source code, compromise databases, deploy ransomware, or pivot laterally into the internal corporate network, leading to severe operational disruption and data breaches.
Official Vendor Advisories & References
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Frequently Asked SecOps Questions (CVE-2026-120201)
FAQQ1. How critical is CVE-2026-120201 and is it actively exploited in the wild?
CVE-2026-120201 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 2.2%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120201?
Primary impacted vendors include dromara across jpom. Scope summary: Jpom versions 2.10.0 through 2.11.12 (all deployments utilizing the vulnerable Hutool Condition parser for token validation)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120201 before patching?
[Mitigation] Immediately upgrade Jpom to the patched version (2.11.13 or later) and restrict external access to the management console Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120201
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (dromara)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.