jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL and JMXConnectorFactory for establishing the remote JMX connection. The existing denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, which can be bypassed using alternative valid JMX service URL forms, including ldaps:// schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid JMXServiceURL objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.jolokia:jolokia-service-jsr160 | < 2.6.2 | 2.6.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-84218
- https://github.com/jolokia/jolokia/issues/1049
- https://access.redhat.com/security/cve/CVE-2026-84218
- https://bugzilla.redhat.com/show_bug.cgi?id=2526752
- https://github.com/advisories/GHSA-c9ff-59g8-m36q
- https://github.com/jolokia/jolokia
- https://jolokia.org/#jolokia_2_6_2_released_with_security_fixes
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-184- Platform
- Java / Kotlin (Maven)
- Package
org.jolokia:jolokia-service-jsr160- Disclosed
- 01.09.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-c9ff-59g8-m36q - CC BY 4.0
Vulnerability history: org.jolokia:jolokia-service-jsr160
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.