CVE-2024-29201

CVE-2024-29201 is a critical vulnerability affecting JumpServer, an open-source bastion host. An attacker with low privileges can bypass input validation in JumpServer's Ansible component, leading to arbitrary code execution within the Celery container. This container runs with root privileges and database access, allowing for potential theft of sensitive data or database manipulation. The vulnerability has a CVSS score of 9.9 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or significant community discussion, the high EPSS and FAUCET Risk Score indicate a substantial potential for future exploitation.