CVE-2026-31798

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31798", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T16:33:42.912Z", "datePublished": "2026-03-13T19:15:26.081Z", "dateUpdated": "2026-03-13T19:38:35.576Z"}, "containers": {"cna": {"title": "JumpServer Improper Certificate Validation in Custom SMS API Client", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7"}], "affected": [{"vendor": "jumpserver", "product": "jumpserver", "versions": [{"version": "< 4.10.16-lts", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:15:26.081Z"}, "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts."}], "source": {"advisory": "GHSA-26pj-mmxw-w3w7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T19:38:25.725504Z", "id": "CVE-2026-31798", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:38:35.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31798", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T19:38:25.725504Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T19:38:30.576Z"}}], "cna": {"title": "JumpServer Improper Certificate Validation in Custom SMS API Client", "source": {"advisory": "GHSA-26pj-mmxw-w3w7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "jumpserver", "product": "jumpserver", "versions": [{"status": "affected", "version": "< 4.10.16-lts"}]}], "references": [{"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7", "name": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T19:15:26.081Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31798", "state": "PUBLISHED", "dateUpdated": "2026-03-13T19:38:35.576Z", "dateReserved": "2026-03-09T16:33:42.912Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T19:15:26.081Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jumpserver", "vendor": "jumpserver", "versions": [{"status": "affected", "version": "< 4.10.16-lts"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fit2cloud:jumpserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "43DC809F-FE8B-457E-B4D4-1226A1A8E5F8", "versionEndExcluding": "4.10.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When JumpServer sends MFA/OTP codes via Custom SMS API, an attacker can intercept the request and capture the verification code BEFORE it reaches the user's phone. This vulnerability is fixed in v4.10.16-lts."}, {"lang": "es", "value": "JumpServer es un host basti\u00f3n de c\u00f3digo abierto y un sistema de auditor\u00eda de seguridad de operaci\u00f3n y mantenimiento. Antes de la v4.10.16-lts, JumpServer valida incorrectamente los certificados en el Cliente API de SMS Personalizado. Cuando JumpServer env\u00eda c\u00f3digos MFA/OTP a trav\u00e9s de la API de SMS Personalizado, un atacante puede interceptar la solicitud y capturar el c\u00f3digo de verificaci\u00f3n ANTES de que llegue al tel\u00e9fono del usuario. Esta vulnerabilidad se corrige en la v4.10.16-lts."}], "id": "CVE-2026-31798", "lastModified": "2026-06-17T10:34:29.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31798", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T19:38:25.725504Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:36.097", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-26pj-mmxw-w3w7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.10.16-lts)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jumpserver", "source": "cna", "vendor": "jumpserver"}, "product": "jumpserver", "vendor": "jumpserver"}], "analysis": {"en": {"generated_at": "2026-03-18T15:28:19.134375+00:00", "value": {"mitigation_remediation": ["Apply the JumpServer v4.10.16-lts or later patch to enforce proper certificate validation", "Verify that the Custom SMS API client performs full TLS certificate verification after patching", "If immediate patching is not possible, disable or remove the Custom SMS API feature until a fix is deployed", "Monitor network traffic for unexpected TLS certificate validation failures or interception of MFA traffic"], "summary": {"action": "Apply Patch", "impact": "MFA/OTP code interception leading to potential account takeover"}, "threat_synthesis": {"affected_systems": "Affected systems include the JumpServer open source bastion host with any version prior to 4.10.16-lts. The product is identified as jumpserver:jumpserver. No specific revision list is provided beyond the stated fix version; all earlier releases are vulnerable.", "description_and_impact": "The vulnerability exists because the Custom SMS API Client in JumpServer does not properly validate TLS certificates when sending multi-factor authentication (MFA) or one-time password (OTP) codes. As a result, an attacker can intercept the outbound request and capture the verification code before it reaches the intended user, enabling unauthorized access to protected accounts. This weakness is a certificate validation failure (CWE\u2011295).", "risk_and_exploitability": "The CVSS score of 5 indicates moderate severity, and the EPSS score is below 1%, suggesting a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to intercept or manipulate network traffic targeting the Custom SMS API endpoint, so the attack vector is likely network-based and may be limited to environments without strict TLS enforcement. Given the moderate score and low EPSS, the risk is considered moderate but not negligible."}}}}, "created": "2026-03-16T09:24:21.426981+00:00", "updated": "2026-03-23T13:40:15.738995+00:00", "vendors": ["jumpserver", "jumpserver$PRODUCT$jumpserver"]}