JumpServer's insecure Ansible playbook validation leads to RCE in Celery

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.

Scores

EPSS (exploitation in 30 days)

6.0% · top 6.7% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

• CWE-94: Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• jumpserver · jumpserver

  • affected >= 3.0.0, <= 3.10.6

References (2)

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-2-2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-29201](https://trackcve.app/badge/CVE-2024-29201.svg)](https://trackcve.app/cve/CVE-2024-29201)

Record last updated 25 Mar 2025, 19:38 UTC.