Skip to content
fr Sign in
8.1 High

CVE-2026-84218 A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service…

Description

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Apache Camel 4 for Quarkus 3 Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat AMQ Broker 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Apache Camel 4 for Quarkus 3

The 75 CVEs of Red Hat build of Apache Camel 4 for Quarkus 3 →
CVE-2026-107912 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 7.7 High CVE-2026-120971 A flaw was found in RESTEasy's default exception mapper 5.3 Medium CVE-2026-119542 A flaw was found in the Ickle query parser in Infinispan 4.3 Medium CVE-2026-94449 Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service 7.5 High
Track this CVE