Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by redhat

CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)

High 8.1

In plain English

A high-severity security flaw in Red Hat AMQ Broker 7 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.9%top 38.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.jolokia:jolokia-service-jsr1602.6.2GHSA-c9ff-59g8-m36q

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat AMQ Broker 7 see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 see references
Red Hat Red Hat build of Apache Camel for Spring Boot 4 see references
Red Hat Red Hat build of Apache Camel for Spring Boot 4 see references
Red Hat Red Hat Fuse 7 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Satellite 6 see references

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References