{"action":"Upgrade github.com/jumpserver/jumpserver to 3.5.6+incompatible or later.","affected":[{"fixed":"3.5.6+incompatible","introduced":"0"},{"fixed":"3.6.5+incompatible","introduced":"3.6.0+incompatible"}],"component":"github.com/jumpserver/jumpserver","cve_ids":["CVE-2023-42818"],"ecosystem":"Go","epss":0.00675,"exploited":false,"fixed_versions":["3.5.6+incompatible","3.6.5+incompatible"],"ghsa_id":"GHSA-jv3c-27cv-w8jv","id":"tcs_01M5KG7TN656SHP35EN01FMMDK","modified_at":"2026-03-03T04:56:27.877919Z","published_at":"2025-06-12T14:09:53Z","references":["https://osv.dev/vulnerability/GO-2025-3570","https://nvd.nist.gov/vuln/detail/CVE-2023-42818","https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jv","https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2025-3570#Go/github.com/jumpserver/jumpserver","url":"https://osv.dev/vulnerability/GO-2025-3570"}],"summary":"SSH public key login without private key challenge if mfa is enabled in jumpserver in github.com/jumpserver/koko in github.com/jumpserver/jumpserver"}