CVE-2026-84218
Received Received - Intake

Jolokia JSR-160 Proxy JMX URL Bypass Vulnerability

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: redhat-SADP

Description
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84218
EUVD
EUVD-2026-69129

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jolokia jolokia *
jolokia jolokia 1.*
jolokia jolokia 2.*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Jolokia's JSR-160 proxy where insufficient validation of client-controlled JMX service URLs allows bypassing a denylist meant to mitigate CVE-2018-1000130. The proxy accepts a target.url from Jolokia POST requests and uses it to establish remote JMX connections. The denylist only blocks URLs matching service:jmx:rmi:///jndi/ldap:.* but can be bypassed using alternative forms like ldaps:// schemes or LDAP URLs with a non-empty JMX host component. This enables JNDI lookups to attacker-controlled LDAP endpoints, leading to SSRF, credential forwarding, or potential remote code execution depending on the target JVM's configuration.

Detection Guidance

To detect this vulnerability, monitor Jolokia proxy logs for JMX service URL requests containing LDAP or LDAPS schemes, non-empty JMX host components, or alternative JNDI patterns. Check for outbound connections to unexpected LDAP endpoints from Jolokia agent JVMs. Use network traffic analysis tools to inspect JNDI lookup attempts initiated by Jolokia.

Impact Analysis

If you use Jolokia's JSR-160 proxy exposed to untrusted input, an attacker could force your system to make outbound JNDI connections to malicious endpoints. This may result in server-side request forgery, exposure of JMX credentials, or remote code execution if exploitable classes are present in your JVM. The impact depends on your specific deployment and configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, SSRF, or RCE, which may violate GDPR's data protection requirements (e.g., Article 32 security of processing) and HIPAA's safeguards for protected health information (e.g., 45 CFR § 164.308(a)(1)(ii)(B)). Exposure of credentials or data via SSRF/RCE risks non-compliance with confidentiality and integrity controls.

Mitigation Strategies

Immediately disable the Jolokia JSR-160 proxy if exposed to untrusted input. Upgrade to a patched Jolokia version that enforces an allowlist for JMX service URLs. If upgrading is not possible, restrict network access to the Jolokia proxy and block outbound LDAP/LDAPS connections from affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart