CVE-2024-29201: JumpServer's insecure Ansible playbook validation leads to RCE in Celery
Vulnerability summary
CVE-2024-29201 is a critical (CVSS 10.0) Improper Control of Generation of Code vulnerability in fit2cloud jumpserver. EPSS estimates a 5.99% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 29-03-2024PublishedVulnerability first disclosed.
- 25-03-2025Last modifiedVulnerability information updated.
Description
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
5.99%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
Increase +0.05 pp
From 5.94% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJumpserver
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Fit2cloud1 product
- jumpserver≥ 3.0.0, < 3.10.7
Jumpserver1 product
- jumpserver≥ 3.0.0, ≤ 3.10.6
2 vendors · 2 products
References
2 links- github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwjX Refsource CONFIRMExploitVendor Advisory