CVE-2026-58301
Received Received - Intake

Remote Code Execution in Apache Shiro Jakarta EE

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: Apache Software Foundation

Description
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-58301
EUVD
EUVD-2026-68391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache shiro From 2.0.0 (exc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Shiro allows a low-privileged user to send a specially crafted HTTP request that forces the server to connect to an attacker-controlled URL and transmit data controlled by the attacker. This only affects versions 2.x through 3.0.0 when using the Jakarta EE integration module.

Detection Guidance

Detecting this vulnerability requires checking if Apache Shiro is running with the Jakarta EE integration module and if the version is vulnerable. Inspect server logs for unusual outbound connections to external URLs initiated by the application. Use commands like 'netstat -tuln' or 'ss -tuln' to monitor active connections. Check Shiro version with 'find / -name shiro-core*.jar' and verify if it falls within 2.0.0-alpha-0 to 3.0.0.

Impact Analysis

An attacker could exploit this to exfiltrate sensitive data from your server or interact with internal systems. This could lead to data breaches, unauthorized access, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is leaked.

Mitigation Strategies

Upgrade Apache Shiro to version 3.0.1 or later. Alternatively, set the system properties org.apache.shiro.form-resubmit-host and org.apache.shiro.form-resubmit-port to restrict the host and port for form resubmission.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58301. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart