Paper/Archive/CVE-2026-123965

CVE-2026-123965

Jet Admin Jet Admin Cloud Platform — Jet Admin cloud platform prompt injection

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.

Affected

ProductAffectedFixed inSource

Jet Admin Cloud Platformall versions–CNA

Scores by source

cisa-cg (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

cisa-cg (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjetadmin.io refjetadmin.io/changelog writeupraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-317-01.json refcve.org/CVERecord?id=CVE-2026-123965