CVE-2026-84218
Description
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL and JMXConnectorFactory for establishing the remote JMX connection. The existing denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, which can be bypassed using alternative valid JMX service URL forms, including ldaps:// schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid JMXServiceURL objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.
Statement
This is an Important flaw in Jolokia's JSR-160 proxy mode, allowing an attacker to bypass the JNDI denylist. The incomplete denylist permits specially crafted JMX service URLs to trigger JNDI lookups against attacker-controlled endpoints, potentially leading to remote code execution. This risk is elevated in deployments where the Jolokia JSR-160 proxy is exposed to untrusted input.
This vulnerability is an incomplete fix for CVE-2018-1000130.
Red Hat Satellite is not affected by this vulnerability. The flaw is in Jolokia's JSR-160 proxy module. Satellite's puppetserver and openvox-server include Jolokia only as a transitive dependency through trapperkeeper-metrics, which pulls in the core Jolokia libraries but does not pull in the JSR-160 proxy module. Jolokia is modular. The proxy feature is an optional plugin. Satellite uses Jolokia only for local JMX metrics monitoring and it never needed the proxy plugin, so it was never included in the dependency chain. Since the vulnerable code is never included in the build, it s not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Acknowledgements
This issue was discovered by Sandipan Roy (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
