{"schema":"threatline.record/2","record":{"id":"CVE-2026-84218","aliases":["GHSA-c9ff-59g8-m36q"],"summary":"jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input","details":"A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.","categories":["Operating systems"],"product":"org.jolokia:jolokia-service-jsr160","vendor":"Red Hat","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c9ff-59g8-m36q","source_modified_at":"2026-10-07T18:04:16Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.jolokia:jolokia-service-jsr160"},"range":"< 2.6.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat AMQ Broker 7","vendor":"Red Hat","versions":[],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat build of Apache Camel 4 for Quarkus 3","vendor":"Red Hat","versions":[],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat build of Apache Camel 4 for Quarkus 3","vendor":"Red Hat","versions":[],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat build of Apache Camel for Spring Boot 4","vendor":"Red Hat","versions":[],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat build of Apache Camel for Spring Boot 4","vendor":"Red Hat","versions":[],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat Fuse 7","vendor":"Red Hat","versions":[],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat Satellite 6","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","source_modified_at":"2026-09-02T08:54:18.569Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Red Hat Satellite 6","vendor":"Red Hat","versions":[],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c9ff-59g8-m36q","source_modified_at":"2026-10-07T18:15:10.799001851Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.jolokia:jolokia-service-jsr160","purl":"pkg:maven/org.jolokia/jolokia-service-jsr160"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.6.2"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.0-M1","2.0.0-M2","2.0.0-M3","2.0.0-M4","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.6.0","2.6.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c9ff-59g8-m36q","source_modified_at":"2026-10-07T18:04:16Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.jolokia:jolokia-service-jsr160"},"version":"2.6.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c9ff-59g8-m36q","source_modified_at":"2026-10-07T18:15:10.799001851Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.jolokia:jolokia-service-jsr160","purl":"pkg:maven/org.jolokia/jolokia-service-jsr160"},"version":"2.6.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00949,"percentile":0.60863,"score_date":"2026-10-23"},"published_at":"2026-09-01T13:20:27.900Z","modified_at":"2026-10-07T18:15:10.799001851Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-c9ff-59g8-m36q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T18:04:16Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-84218","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-02T08:54:18.569Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-c9ff-59g8-m36q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T18:15:10.799001851Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84218","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84218","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/jolokia/jolokia/issues/1049"},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-84218","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526752","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://github.com/advisories/GHSA-c9ff-59g8-m36q"},{"source":"CVE List","url":"https://jolokia.org/#jolokia_2_6_2_released_with_security_fixes"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-01T14:33:30.514418Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T18:15:10.799001851Z","content_hash":"d0bc4809eb3e3045646d4cbe8eff65a414a6886b31fe683ce97f44adba9a88f9"}}