CVE-2021-3169: Jumpserver

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.

Affected products

• Jumpserver Jumpserver: from 2.4.0, before 2.4.5 (fixed in 2.4.5); from 2.5.0, before 2.5.4 (fixed in 2.5.4); from 2.6.0, before 2.6.2 (fixed in 2.6.2)

Published 2021-07-23. Last modified 2026-06-17.