CVE-2026-113730

Received Received - Intake

OGNL Reflection Bypass in Java Library

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113730

Affected Vendors & Products

Vendor	Product	Version / Range
orphan-oss	ognl	< 3.4.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability in OGNL (Object Graph Navigation Library for Java) before version 3.4.13 allows an attacker to bypass stricter invocation checks by using reflection objects like Method, Constructor, or Field. The stricter mode checks the declaring class of invoked methods but fails to block these reflection objects, enabling execution of operations without proper validation.

Detection Guidance

Detection requires checking if your system uses OGNL versions prior to 3.4.13. Review application dependencies for OGNL and verify the version in use. No specific commands are provided for detection in the given context.

Impact Analysis

If you use an application that evaluates untrusted OGNL expressions with permissive MemberAccess settings, an attacker could exploit this to execute arbitrary code or access sensitive data. Applications using restrictive MemberAccess, like Apache Struts with SecurityMemberAccess, are not affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or code execution, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations must ensure patched versions are deployed to maintain compliance.

Mitigation Strategies

Upgrade OGNL to version 3.4.13 or later to address the vulnerability. Ensure applications using OGNL do not evaluate untrusted expressions or use permissive MemberAccess configurations.

Hi! I’m here to help you understand CVE-2026-113730. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...