What is the CVSS score of CVE-2026-31798?

CVE-2026-31798 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Jumpserver are affected by CVE-2026-31798?

Organizations using JumpServer should be aware of moderate risk from CVE-2026-31798 rated CVSS 5.0. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-31798?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Jumpserver CVE-2026-31798

EUVD-2026-12081 MEDIUM

Improper Certificate Validation (CWE-295)

2026-03-13 GitHub_M

Information Disclosure Jumpserver

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.10.16-lts

EUVD ID Assigned

Mar 13, 2026 - 20:00 euvd

EUVD-2026-12081

Analysis Generated

Mar 13, 2026 - 20:00 vuln.today

CVE Published

Mar 13, 2026 - 19:15 nvd

MEDIUM 5.0

DescriptionGitHub Advisory

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts.

AnalysisAI

JumpServer prior to version 4.10.16-lts improperly validates certificates when sending MFA/OTP codes through a Custom SMS API Client, allowing an attacker to intercept SMS verification requests and capture one-time passcodes before they reach the user's phone. This vulnerability affects organizations using JumpServer as a bastion host and operational security audit system, potentially enabling unauthorized authentication bypass. The CVSS score of 5.0 and CWE-295 (Improper Certificate Validation) classification indicate a moderate but exploitable vulnerability requiring user interaction and moderate attack complexity.

Technical ContextAI

The vulnerability resides in JumpServer's Custom SMS API Client implementation, which fails to properly validate SSL/TLS certificates when communicating with external SMS providers to deliver multi-factor authentication (MFA) and one-time password (OTP) codes. This root cause falls under CWE-295 (Improper Certificate Validation), a well-known weakness in the CWE-290 series related to cryptographic failures. The affected technology is the HTTPS/TLS communication layer used for SMS delivery orchestration within JumpServer's authentication flow. When JumpServer initiates an outbound request to deliver SMS OTP codes, insufficient certificate pinning or validation mechanisms allow a network-positioned attacker to perform man-in-the-middle (MITM) interception. The Custom SMS API Client component, rather than built-in SMS providers, is specifically vulnerable, meaning organizations using third-party SMS gateway integrations are at elevated risk. CPE identification would be cpe:2.3:a:jumpserver:jumpserver for the affected bastion host software.

RemediationAI

Immediately upgrade JumpServer to version 4.10.16-lts or later to apply the certificate validation fix in the Custom SMS API Client. This is the definitive remediation and should be prioritized in maintenance windows. Until patching is feasible, implement compensating controls by deploying a reverse proxy or API gateway with strict TLS 1.2+ enforcement, certificate pinning policies, and HSTS headers between JumpServer and the external SMS provider. Additionally, restrict outbound network access from the JumpServer instance to only the IP addresses and domains of your contracted SMS provider(s) using egress firewall rules, and consider enabling mutual TLS (mTLS) authentication if your SMS provider supports it. Monitor outbound HTTPS connections for anomalies using network IDS/IPS. For maximum security posture during the patch window, consider temporarily augmenting MFA with hardware tokens or application-based authenticators (TOTP) that do not rely on SMS delivery. Consult the official JumpServer security advisory and release notes for specific version guidance and any additional security improvements included in the 4.10.16-lts release.