Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)

Summary

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

Timeline

1. Sep 1, 2026, 1:20 PM UTCCVE published
2. Sep 1, 2026, 2:33 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Sep 2, 2026, 8:54 AM UTCRecord last updated

Affected versions

• jolokia-server-core

  Version range not reported

• jolokia-core

  Version range not reported

• jolokia-server-core

  Version range not reported

• jolokia-core

  Version range not reported

• jolokia-server-core

  Version range not reported

• jolokia-core

  Version range not reported

• openvox-server

  Version range not reported

• puppetserver

  Version range not reported

• org.jolokia:jolokia-service-jsr160Maven

  fixed in 2.6.2

References 5