All vulnerabilities
CVE-2026-84218GHSA-c9ff-59g8-m36q

org.jolokia:jolokia-service-jsr160: jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input

Red Hat org.jolokia:jolokia-service-jsr160mavenOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.95%Chance of exploitation activity in the next 30 days, higher than 60% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.6.2Fixed versionGitHub
Published1 Sep 2026Updated 7 Oct 2026CVE List

What fixes it

  • 2.6.2org.jolokia:jolokia-service-jsr160, mavenGitHub<dependency><groupId>org.jolokia</groupId><artifactId>jolokia-service-jsr160</artifactId><version>2.6.2</version></dependency>
  • 2.6.2org.jolokia:jolokia-service-jsr160, MavenOSV<dependency><groupId>org.jolokia</groupId><artifactId>jolokia-service-jsr160</artifactId><version>2.6.2</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL and JMXConnectorFactory for establishing the remote JMX connection. The existing denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, which can be bypassed using alternative valid JMX service URL forms, including ldaps:// schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid JMXServiceURL objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

Text from CVE List

Affected versions 32

  • org.jolokia:jolokia-service-jsr160, maven< 2.6.2GitHub
  • org.jolokia:jolokia-service-jsr160, Mavenfrom first release, fixed in 2.6.2OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.0-M1OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.0-M2OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.0-M3OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.0-M4OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.1OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.2OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.0.3OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.1.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.1.1OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.1.2OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.1OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.2OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.3OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.4OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.5OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.6OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.7OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.8OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.2.9OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.3.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.4.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.4.1OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.4.2OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.4.3OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.5.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.5.1OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.6.0OSV
  • org.jolokia:jolokia-service-jsr160, Maven2.6.1OSV

References 6