JumpServer’s Ansible automation rendering can evaluate attacker‑controlled template expressions from users who are allowed to create or execute affected automation tasks. By embedding Jinja expressions that call Ansible lookup plugins such as file, pipe, env, or password, the attacker can read sensitive files, retrieve environment values, or potentially run limited commands within the automation process’s privileges. The flaw does not provide unauthenticated access to the JumpServer system or unrelated assets.

All users of JumpServer, an open‑source bastion host, who can create or run automation tasks are affected when the system is running any version earlier than 4.10.17‑lts. The vulnerability is fixed in version 4.10.17‑lts and later.

The CVSS base score of 6 indicates a moderate severity. Because the flaw requires authenticated permissions to create or execute automation tasks, the attack vector is constrained to insiders or compromised privileged users. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, an attacker with the necessary privileges could disclose sensitive data and conduct limited command execution inside the automation process, representing a significant risk to confidentiality and integrity for the affected environment.