CVE-2026-32295: Jetkvm KVM Auth Bypass Vulnerability

CVE-2026-32295 Overview

CVE-2026-32295 affects JetKVM, a network-attached keyboard-video-mouse (KVM) device used for remote out-of-band server management. Versions prior to 0.5.4 do not enforce rate limiting on login requests. Attackers reachable over the network can submit unlimited authentication attempts to guess valid credentials. Successful brute-force grants console-level access to managed hosts, including pre-boot environments and BIOS/UEFI interfaces. The weakness is tracked as [CWE-307: Improper Restriction of Excessive Authentication Attempts].

Critical Impact
Unauthenticated network attackers can brute-force the JetKVM login interface to obtain full remote console access to attached systems.

Affected Products

JetKVM kvm firmware versions prior to 0.5.4
Deployments exposing the JetKVM web interface to untrusted networks
Environments where JetKVM devices use weak or default credentials

Discovery Timeline

2026-03-17 - CVE-2026-32295 published to NVD
2026-04-10 - Last updated in NVD database

Technical Details for CVE-2026-32295

Vulnerability Analysis

JetKVM exposes a web-based authentication endpoint for remote operators. Versions before 0.5.4 accept consecutive login attempts from the same source without throttling, lockout, or progressive delay. An attacker can script high-volume credential guessing against the login form or its underlying API.

Because JetKVM provides hardware-level console control over attached servers, a compromised credential is equivalent to physical access. An operator with valid credentials can power-cycle the host, attach virtual media, and interact with pre-OS firmware. Brute-forcing the login therefore bypasses every host-side endpoint and identity control on the managed system.

The issue is classified under [CWE-307] and was remediated in JetKVM release 0.5.4, published on the project's GitHub release page. Additional background on KVM exposure risk is documented in the Eclypsium analysis of KVM devices.

Root Cause

The authentication handler in affected firmware lacks attempt counters, account lockout, IP-based throttling, and exponential backoff. Each request is evaluated on credential correctness alone, with no protective state tracking across failed submissions.

Attack Vector

The attack is remote and unauthenticated. An attacker who can reach the JetKVM management interface over TCP can submit credential pairs through automated tooling. No user interaction or prior foothold is required. Devices exposed to the internet, or reachable from a compromised internal host, are at greatest risk.

No public proof-of-concept exploit code has been published for CVE-2026-32295. The exploitation technique is generic credential brute-forcing against the JetKVM login endpoint and does not require custom tooling.

Detection Methods for CVE-2026-32295

Indicators of Compromise

High volumes of HTTP POST requests to the JetKVM login endpoint from a single source IP or distributed sources
Repeated authentication failure events in JetKVM logs immediately preceding a successful login
Successful logins from geographies or networks that do not match operator baselines
Unexpected virtual media mounts, power events, or console sessions initiated through JetKVM

Detection Strategies

Forward JetKVM access logs to a SIEM and alert on failed-login rate thresholds per source IP
Correlate JetKVM authentication failures with downstream host BMC, BIOS, or boot-order changes
Monitor egress and management VLAN flows for scanning behavior targeting JetKVM TCP ports
Inventory JetKVM firmware versions and flag any device reporting a version earlier than 0.5.4

Monitoring Recommendations

Track all administrative session creations on JetKVM and tie them to a named operator and ticket
Alert on any JetKVM management interface that becomes reachable from outside an approved subnet
Baseline normal login frequency per device and alert on statistical deviation

How to Mitigate CVE-2026-32295

Immediate Actions Required

Upgrade all JetKVM devices to firmware 0.5.4 or later using the official JetKVM 0.5.4 release
Remove JetKVM management interfaces from the public internet and restrict access to a dedicated management VLAN
Rotate all JetKVM credentials and replace any default or shared passwords with strong, unique values
Review authentication logs for evidence of prior brute-force activity or unauthorized successful logins

Patch Information

The vulnerability is fixed in JetKVM kvm release 0.5.4. The CISA coordinated advisory is published as CSAF VA-26-076-01, and the authoritative CVE record is available at CVE-2026-32295 on cve.org.

Workarounds

Place JetKVM behind a VPN or zero-trust network access gateway that enforces its own rate limiting and MFA
Apply firewall rules to permit JetKVM access only from a small allowlist of administrator workstations
Add an upstream reverse proxy that enforces login attempt throttling and IP-based lockout
Disable or physically disconnect JetKVM devices that cannot be promptly updated to 0.5.4

bash

# Example firewall allowlist limiting JetKVM access to a management subnet
iptables -A INPUT -p tcp --dport 80  -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP