Summary
CVE-2026-84218 is a JNDI injection vulnerability in the Jolokia agent’s JSR-160 proxy mode, caused by an incomplete denylist that was meant to close out the original proxy JNDI flaw, CVE-2018-1000130. Because the denylist regex only matches a narrow set of service:jmx:rmi:///jndi/ldap: strings, attackers can submit alternate JMX service URL forms (such as ldaps:// schemes or URLs with a non-empty JMX host component) to bypass the filter and force the Jolokia agent to perform a JNDI lookup against an attacker-controlled LDAP server. The issue affects Jolokia’s jolokia-core component and carries a CVSS v3.1 base score of 8.1 (High), with confidentiality, integrity, and availability impact all rated High.
Technical details
- Root cause: The JSR-160 proxy denylist introduced to fix CVE-2018-1000130 uses the regex
service:jmx:rmi:///jndi/ldap:.*, which only blocks the exactldap:scheme with an empty JMX host segment (i.e., exactly three slashes afterrmi:). This is classified as CWE-184 (Incomplete List of Disallowed Inputs). - Trigger conditions: An attacker sends a crafted JMX service URL to a Jolokia agent running with JSR-160 proxy mode enabled, using either the
ldaps://scheme (not covered by the denylist) or a URL containing a non-empty JMX host component (e.g.,service:jmx:rmi://<host>/jndi/ldap://...), both of which evade the string match while still resolving to a JNDI lookup. - Attack vector: Network — the flaw is exploitable by any client able to reach the Jolokia agent’s JSR-160 proxy endpoint; per Red Hat’s CVSS vector, attack complexity is High and no privileges or user interaction are required.
- Impact: A successful bypass causes the agent’s JVM to perform a JNDI/LDAP lookup against an endpoint the attacker controls, enabling server-side request forgery (SSRF), forwarding/leakage of authentication material during the LDAP bind, and — in environments where a JNDI-triggerable deserialization/factory gadget is reachable on the classpath (e.g., certain application server configurations) — remote code execution.
- Deployments that already configure an explicit allowlist (
jsr160ProxyAllowedTargets) for permitted JMX proxy targets are not affected, since the vulnerable code path is the fallback denylist logic used when no allowlist is configured.
Affected software
- Jolokia (
org.jolokia:jolokia-core), JSR-160 proxy mode:- Jolokia 1.x: versions 1.5.0 through the latest 1.x releases
- Jolokia 2.x: versions up to and including 2.6.1
- Downstream distributions bundling
jolokia-corewith JSR-160 proxy mode enabled, including:- Red Hat build of Apache Camel for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Fuse 7
- Red Hat Satellite 6 (via the
puppetserverpackage) - (Fix/patch status for these downstream packages was listed as "Unknown" at time of tracking.)
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: As of this writing, no upstream Jolokia release or downstream vendor patch specifically fixing CVE-2026-84218 has been published; the upstream tracking issue remains open (status: new). Monitor the upstream Jolokia project and your distribution’s security advisories for a fixed release and upgrade as soon as one is available.
- Workarounds (recommended now):
- Configure an explicit
jsr160ProxyAllowedTargetsallowlist restricting the JMX service URLs the proxy will accept; deployments with a strict allowlist configured are not exploitable by this issue. - If JSR-160 proxy mode is not required, disable it entirely.
- Restrict network access to the Jolokia agent’s HTTP endpoint to trusted hosts only (e.g., via firewall rules, security groups, or a reverse proxy with authentication), since the flaw requires network reachability to the agent.
- Ensure Jolokia agents are not exposed to the public internet and require authentication for any management endpoint that exposes the JSR-160 proxy feature.
- Configure an explicit