GHSA-c9ff-59g8-m36q

Source

https://github.com/advisories/GHSA-c9ff-59g8-m36q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c9ff-59g8-m36q/GHSA-c9ff-59g8-m36q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c9ff-59g8-m36q

Aliases

CVE-2026-84218

Downstream

CGA (12)

MINI (2)

Published

2026-09-01T15:31:13Z

Modified

2026-10-07T18:15:10Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input

Details

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL and JMXConnectorFactory for establishing the remote JMX connection. The existing denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, which can be bypassed using alternative valid JMX service URL forms, including ldaps:// schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid JMXServiceURL objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

Database specific

{
    "cwe_ids": [
        "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T18:04:11Z",
    "nvd_published_at": "2026-09-01T14:17:49Z",
    "severity": "HIGH"
}

References

Affected packages

Maven / org.jolokia:jolokia-service-jsr160

Package

Name: org.jolokia:jolokia-service-jsr160; View open source insights on deps.dev
Purl: pkg:maven/org.jolokia/jolokia-service-jsr160

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.6.2

Affected versions

2.*

2.0.0-M1

2.0.0-M2

2.0.0-M3

2.0.0-M4

2.0.0

2.0.1

2.0.2

2.0.3

2.1.0

2.1.1

2.1.2

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.5.0

2.5.1

2.6.0

2.6.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-c9ff-59g8-m36q/GHSA-c9ff-59g8-m36q.json"