Jolokia JSR-160 Proxy Functionality Vulnerability in Red Hat
CVE-2026-84218

8.1HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Build Of Apache Camel For Spring Boot 4
Red Hat Fuse 7
Red Hat Satellite 6
Vendor
CVE Published:
1 September 2026

What is CVE-2026-84218?

A vulnerability exists in the JSR-160 proxy functionality of Jolokia, where inadequate validation of client-controlled JMX service URLs can lead to a security bypass. The flaw allows the usage of alternative valid JMX service URL formats to circumvent the denial list designed to mitigate earlier vulnerabilities. By accepting malicious URLs, this vulnerability facilitates server-side request forgery (SSRF), which can compromise JMX credentials, leading to further exploitation such as unauthorized code execution depending on the environment's configurations and available classes.

References

https://access.redhat.com/security/cve/CVE-2026-84218
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526752
issue-trackingx_refsource_REDHAT
https://github.com/jolokia/jolokia/issues/1049

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Sandipan Roy (Red Hat).
.