High 8.1Published Sep 1, 2026

CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)

Updated under an hour ago (Oct 28, 2026, 6:23 AM ET)

Does this affect you?

It affects Red Hat AMQ Broker 7 and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Red Hat AMQ Broker 7

Exploited in the last 30 days

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-184
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: redhat
NVD analysis: Awaiting Analysis
Record last updated: Sep 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Red Hat Red Hat AMQ Broker 7 redhat:amq_broker	7	CNA record
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 redhat:camel_quarkus	3	CNA record
Red Hat Red Hat build of Apache Camel for Spring Boot 4 redhat:camel_spring_boot	4	CNA record
Red Hat Red Hat Fuse 7 redhat:jboss_fuse	7	CNA record
Red Hat Red Hat Satellite 6 redhat:satellite	6	CNA record

References

References

https://access.redhat.com/security/cve/CVE-2026-84218	vdb-entry, x-refsource-redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2526752	issue-tracking, x-refsource-redhat
https://github.com/advisories/GHSA-c9ff-59g8-m36q
https://github.com/jolokia/jolokia/issues/1049
https://jolokia.org/#jolokia_2_6_2_released_with_security_fixes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.