CVE-2026-46495

OpenDJ, an open-source LDAPv3 directory server, is vulnerable to remote code execution via unsafe Java deserialization in its JMX RMI connector prior to version 5.1.1. The RmiConnector processes attacker-controlled serialized credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate accepts an unconstrained Object array instead of a two-element String array, allowing an unauthenticated attacker on the network to submit a crafted serialized Java object that executes code in the server process. Exploitation requires the JMX Connection Handler to be enabled (it is disabled by default) with its TCP listener reachable, and success depends on the runtime classpath and Java version — RCE was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1 on the classpath. No public proof-of-concept exists and the flaw is not in the CISA KEV catalog, so exploitation in the wild is not known. The issue is rated critical (CVSS 4.0: 9.2) and is fixed in OpenDJ 5.1.1.

What to do: Upgrade to OpenDJ 5.1.1 or later. Verify that the JMX Connection Handler is disabled unless explicitly required; if it must run, restrict its TCP port to trusted management networks and set jmx.remote.rmi.server.credentials.filter.pattern to a restrictive allowlist (e.g., permitting only java.lang.String and the JMX credential types). Audit OpenDJ servers for unexpected JMX/RMI connections or anomalous JVM behavior, and review the runtime classpath for gadget libraries such as Jackson.