jumpserver

Improvements

• Support direct editing of existing search condition values, including text, single-select, and multi-select fields

• Support the REPLACE clause with the old password for automated Oracle password changes [JumpServer EE]

• Add a SYSDBA option for Oracle connections through the Web Terminal, Web SQL, and DBeaver [JumpServer EE]

• Support sorting authorized assets by custom name and searching by custom name or comment

• Add pagination for unread site messages and improve loading states, retry handling, and mobile display

• Support pagination and database-type filtering for saved SQL snippets, and add support for saving Dameng SQL snippets

• Increase the argument length limit for jobs and quick commands from 8,192 to 65,536 characters

• Optimize authorization caching and logical session reuse for concurrent database proxy connections while following Core’s token reuse policy

• Optimize filesystem cache usage for long-running SSH session recordings to reduce memory pressure

• Improve Russian translations and fix task log labels that did not follow the current interface language

• Add an optional Approvers column to the ticket audit list and allow opening session details from session tickets [JumpServer EE]

• Support dot-separated paths for nested fields in OAuth2 user attribute mappings [JumpServer EE]

• Support bulk editing of the account password change eligibility setting [JumpServer EE]

• Support LDAP user group mapping based on the OU path in distinguishedName

Bug Fixes

• Fix OTP binding failures caused by secret changes after a page refresh or failed verification, which invalidated codes generated from the previously scanned QR code
• Fix LDAP connection timeout settings not taking full effect, user list sorting errors, and the unavailable periodic synchronization toggle in the Community Edition
• Fix managed passwords not being updated after a successful Windows AD password change when connection verification was inconclusive [JumpServer EE]
• Fix ineffective job cancellation and timeout handling under Docker and bwrap isolation, and clean up executor containers left behind after abnormal exits
• Fix SSH multi-factor authentication issues and port forwarding and command execution errors when connection reuse is disabled, and improve resource cleanup after connection failures
• Fix a busy loop after SSH connections are closed
• Fix fragmented Oracle Thin authentication responses, negotiation data continuation handling, and incomplete reads of data descriptor frames [JumpServer EE]
• Fix invisible remote desktop scrollbars on macOS and inaccessible left-side content in zoomed VNC sessions
• Fix log write failures during consecutive recording conversion tasks
• Fix repeated cloud database synchronization overwriting manually configured default database names [JumpServer EE]
• Fix phone number changes not appearing in user profiles and failed reconnections from recent sessions in the workbench
• Fix duplicate accounts when filtering by asset node, already-authorized assets remaining selectable, and the inability to clear the switch-from account
• Fix dropdowns extending beyond the viewport, encrypted email uniqueness validation, and Bearer authentication fallback compatibility
• Fix password submissions not correctly using SM2/SM4 encryption in environments configured for Chinese cryptographic algorithms

Security Enhancements

• Strengthen login and account binding callback validation for WeCom and DingTalk, prevent implicit binding to local accounts with matching usernames, and enforce one-time validation of callback state [JumpServer EE]
• Strengthen asset address validation to reject template syntax, control characters, and invalid host addresses
• Restrict Celery task, result, and log message serialization to JSON
• Correct permission checks for system tools, quick commands, and remote desktop clipboard operations to enforce both asset operation permi

Improvements

• Update background task records to omit original args and kwargs at creation, reducing unnecessary parameter persistence
• Strengthen persistent write protection for databases and Redis in high availability deployments across container restarts, recreation, and failure recovery
• Improve redeployment completion checks to tolerate normal replication lag, and refine switchover waits and recovery coordination to reduce false failure detection

Bug Fixes

• Validate Access Token format while preserving fallback compatibility with other Bearer Token authentication methods
• Fix NLA configuration and RDP service refresh during Tinker applet host deployment, checking Group Policy and disabling listener NLA before installation, then verifying the configuration afterward; stop deployment with clear guidance when Group Policy requires NLA
• Fix race conditions involving role callbacks, operation locks, and file synchronization acknowledgments during switchover, automatic rejoin, and startup recovery [JumpServer EE]
• Improve MySQL/MariaDB replication position handling and crash recovery, and fix a race condition in PostgreSQL replication slot cleanup during standby rebuilds [JumpServer EE]
• Fix local administrator credential recovery and health checks during MySQL/MariaDB maintenance, avoiding the use of peer credentials or stale application passwords [JumpServer EE]

New Features

• KoKo revamped its TUI terminal experience, restoring plain-text connection mode and introducing an asset tree, search and filtering, mouse controls, multi-session management, and other enhancements for direct KoKo access through SSH clients

• Magnus now supports connections to Dameng Database [JumpServer EE]

• KoKo added support for Windows PowerShell over WinRM and the Dameng Database Web CLI, with WinRM providing command auditing, ACL enforcement, session recording, and AI assistance across Luna Web and desktop clients

• Tinker was redesigned to provide standalone RDP desktops through the Windows authentication plugin, replacing the previous RemoteApp-based approach

• Luna Workspace added support for database connections through DBX, with DBX replacing DBeaver as the default remote database application

• Command filter rules now support AI-assisted drafting and conversational creation through the AI assistant, alongside an improved configuration experience for command filter rules and command groups

• Asset login ACLs now support configurable approval exemption periods, allowing the same user to reconnect to the same asset with the same account without repeated approval during the configured period [JumpServer EE]

• OAuth2 login now supports user group synchronization, configurable user group attribute mapping, and certificate verification modes [JumpServer EE]

• SAML2 remote metadata now supports configurable certificate verification modes [JumpServer EE]

• Zones now support CIDR configuration, enabling assets to be assigned automatically based on their addresses

• Tabs now support persistent grouping that can be restored in future sessions, with drag-and-drop grouping available by dropping one tab onto another

• Added personal credential creation reminders and daily activity summaries, along with recent usage tracking for credentials such as Access Keys, temporary passwords, and connection tokens

• Session recordings now support batch downloads

• Asset authorizations now support configurable expiration reminders

• Work order auditing now supports filtering and exporting by creation time [JumpServer EE]

• JDMC added primary and standby management, system upgrade management, and patch package management

Improvements

• OpenBao now enables HTTPS by default

• Improved MFA configuration so that user settings follow the system configuration by default, with clear prompts for authentication methods that are not enabled at the system level, while MFA is automatically enabled and cannot be disabled when enforced system-wide

• Improved SQL execution plan visualization in Chen Web with a new summary view and quick-access toolbar actions

• Improved work order exports by converting approval workflows, approvers, approval statuses, and related resources into more readable text [JumpServer EE]

• Improved the Lina search experience by allowing users to edit search condition values

• Access control policies now support asset-based selection for connection methods [JumpServer EE]

• LDAP now supports user group mapping through distinguishedName

• Account templates now explicitly identify fields that inherit values from the template

• In-app notifications now support paginated access to all unread messages

• Improved the mobile experience with better connection button adaptation and a more compact layout

• Improved the keyboard and shortcut controls in the lower-right corner of the interface

• Consolidated Celery logs into a single window with separate tabs

• Improved the default Ansible WinRM configuration when HTTPS is enabled

Bug Fixes

• Fixed an issue that could cause KoKo to crash on certain legacy CPUs

• Fixed an issue where node selections were not saved when creating jobs and improved permission, command filter rule, and data masking rule checks when selecting assets through nodes

• Fixed an issue where Redis SS

✨JumpServer v5.0.0 is now available! ✨

JumpServer began as an open source bastion host project in 2014. Through more than a decade of steady growth and continuous iteration, we have kept improving asset connectivity, access control, and operations auditing. The release of JumpServer v5.0 in 2026 marks the start of a new chapter.

JumpServer v5.0 introduces a refreshed native client with a unified entry point for SSH, RDP, Kubernetes, database, and RemoteApp assets, alongside split views, a file workspace, a script library, and SFTP Server connections. New AI-assisted features include command recommendations, real-time operation risk alerts, and automated audit reports, helping teams work more efficiently and review operations more easily. The updated KoKo TUI makes it easier to find assets, choose accounts and protocols, and switch between sessions from an SSH terminal.