EUVD-2026-69129
GHSA-c9ff-59g8-m36q
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered POST requires no auth (PR:N); AC:H reflects non-default proxy enablement and bypass URL crafting; full C/I/A justified by SSRF, credential theft, and conditional RCE.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL and JMXConnectorFactory for establishing the remote JMX connection. The existing denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, which can be bypassed using alternative valid JMX service URL forms, including ldaps:// schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid JMXServiceURL objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.
AnalysisAI
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The JSR-160 proxy feature must be explicitly enabled in the Jolokia agent configuration - it is not the default operating mode and requires deliberate configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity, network-exploitable flaw requiring no authentication (PR:N) if the Jolokia endpoint is exposed without access controls. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply any vendor-released patches from Red Hat for the affected product lines as detailed at https://access.redhat.com/security/cve/CVE-2026-84218; exact fixed versions were not confirmed in the available input data and should be verified directly against the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Red Hat middleware products and versions running Jolokia, and map their network exposure and port accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts,
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Unrestricted archive upload in WildFly Core enables authenticated 'deployer' role users to deploy malicious Java archive
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Fuse images. This i
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Denial of service in WildFly Core (and downstream Red Hat middleware products) allows a remote administrative user to re
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today