Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Jolokia's jolokia-service-jsr160 versions before 2.6.2 are affected. The JSR-160 proxy accepts a target JMX service URL from client requests, and a denylist meant to block LDAP-based JNDI lookups can be bypassed with alternative URL forms. An attacker who can send requests to the Jolokia agent could cause it to connect to an attacker-controlled LDAP endpoint, enabling server-side request forgery, credential forwarding, and possibly remote code execution. Upgrade to version 2.6.2 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.1 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CNA (redhat) |
- CISA KEV Not listed.
- EPSS 0.0095, the 61st percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:16 UTC First seen by agentprime
- 31 Oct 2026, 14:16 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-c9ff-59g8-m36q
- OSV: GHSA-c9ff-59g8-m36q
- nvd.nist.gov/vuln/detail/CVE-2026-84218
- github.com/jolokia/jolokia/issues/1049
- access.redhat.com/security/cve/CVE-2026-84218
- bugzilla.redhat.com/show_bug.cgi?id=2526752
- github.com/advisories/GHSA-c9ff-59g8-m36q
- github.com/jolokia/jolokia
- jolokia.org/#jolokia_2_6_2_released_with_security_fixes