CVE-2026-84218

Name of the Vulnerable Software and Affected Versions Jolokia (affected versions not specified)

Description Insufficient validation of client-controlled JMX service URLs in the JSR-160 proxy functionality allows a bypass of the existing denylist. The proxy accepts a target.url value from a POST request and passes it to JMXServiceURL and JMXConnectorFactory to establish a remote JMX connection. Because the denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, attackers can use alternative forms such as ldaps:// schemes or LDAP URLs with a non-empty JMX host component. This can force the Jolokia agent JVM to perform a JNDI (Java Naming and Directory Interface) lookup against an attacker-controlled LDAP endpoint, potentially leading to server-side request forgery (SSRF), leakage of JMX credentials, or remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.