CVE-2026-84218

CVE-2026-84218 is an incomplete input-denylist flaw (CWE-184) in the JSR-160 proxy mode of the Jolokia JVM agent, allowing a bypass of the mitigation originally added for CVE-2018-1000130. An attacker who can send POST requests to a Jolokia agent with proxy mode enabled supplies a crafted target.url, which the agent passes to JMXServiceURL and JMXConnectorFactory; because the denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, alternative valid forms such as ldaps:// schemes or LDAP URLs with a non-empty host component slip through and cause the agent JVM to perform a JNDI lookup against an attacker-controlled LDAP endpoint. Successful abuse yields server-side request forgery from the agent JVM, disclosure of the JMX credentials supplied in the proxied request to the attacker's endpoint, and potentially remote code execution depending on the classes and configuration available in the target JVM. Only deployments running the Jolokia agent with JSR-160 proxy functionality enabled and reachable by attackers are affected; exact affected version ranges were not provided in the source data. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates a 0.9% chance of exploitation within the next 30 days.

What to do: Inventory Jolokia deployments and determine whether the agent runs with JSR-160 proxy mode enabled and whether its HTTP endpoint accepts untrusted POST requests containing a target URL. Upgrade to the fixed Jolokia release once identified in the vendor/Red Hat advisory (no fixed version was provided in the source data), and as interim mitigations restrict network access to the agent endpoint, disable proxy mode if unused, and limit outbound LDAP/LDAPS egress from the JVM host. Review the JVM configuration for classes and settings that would enable remote code execution via JNDI and monitor for unexpected outbound JNDI/LDAP connections.