CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
Attackers can bypass JNDI denylists in Jolokia's JSR-160 proxy to trigger SSRF and potential remote code execution via crafted JMX URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84218?
CVE-2026-84218 is a high-severity server-side request forgery vulnerability in Red Hat AMQ Broker 7, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only rejects URLs matching `service:jmx:rmi:///jndi/ldap:.*`, which can be bypassed using alternative valid JMX service URL forms, including `ldaps://` schemes or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid `JMXServiceURL` objects and can cause the Jolokia agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. This can result in server-side request forgery (SSRF), forwarding of supplied JMX credentials to the remote endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM.
Weakness: CWE-184
Which versions are affected by CVE-2026-84218?
2 open source packages ship an affected version, including org.jolokia:jolokia-service-jsr160.
| Package | Affected | Fixed in |
|---|---|---|
org.jolokia:jolokia-service-jsr160 Maven | All versions | 2.6.2 |
org.jolokia:jolokia-service-jsr160 Maven | All versions | 2.6.2 |
How do I fix CVE-2026-84218?
Upgrade org.jolokia:jolokia-service-jsr160 to 2.6.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-84218 being exploited?
There is no known exploitation of CVE-2026-84218 in the wild and no public exploit code.
Sources
Also known as ECHO-17d4-6e0b-374f, GHSA-c9ff-59g8-m36q, MINI-28vp-pr5c-3gm7, MINI-fv52-2vpc-5rc8.