CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
Updated under an hour ago ()
Does this affect you?
It affects Red Hat AMQ Broker 7 and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-184
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 2, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat AMQ Broker 7 redhat:amq_broker | 7 | CNA record |
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 redhat:camel_quarkus | 3 | CNA record |
Red Hat Red Hat build of Apache Camel for Spring Boot 4 redhat:camel_spring_boot | 4 | CNA record |
Red Hat Red Hat Fuse 7 redhat:jboss_fuse | 7 | CNA record |
Red Hat Red Hat Satellite 6 redhat:satellite | 6 | CNA record |
References
- https://access.redhat.com/security/cve/CVE-2026-84218vdb-entry, x-refsource-redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2526752issue-tracking, x-refsource-redhat
- https://github.com/advisories/GHSA-c9ff-59g8-m36q
- https://github.com/jolokia/jolokia/issues/1049
- https://jolokia.org/#jolokia_2_6_2_released_with_security_fixes
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.