Jolokia JSR-160 Proxy JNDI Injection Vulnerability

CVE-2026-84218 describes a security vulnerability in the Jolokia JSR-160 proxy functionality. The flaw stems from insufficient validation of client-controlled JMX service URLs, which effectively bypasses the security denylist originally established to address CVE-2018-1000130. By sending a crafted Jolokia POST request, an attacker can manipulate the target.url parameter. Because the existing denylist logic only explicitly rejects standard service:jmx:rmi:///jndi/ldap:.* patterns, it fails to account for alternative valid JMX service URL formats, such as ldaps:// schemes or LDAP URLs containing a non-empty JMX host component.

When processed, these malformed URLs are accepted as valid JMXServiceURL objects, prompting the Jolokia agent JVM to perform an unintended JNDI lookup against an attacker-controlled endpoint. The impact of this behavior ranges from server-side request forgery (SSRF) and the exfiltration of JMX credentials to potential remote code execution (RCE), depending on the specific classes available within the target JVM classpath. This vulnerability is highly relevant for environments deploying Jolokia as an agent for JMX management.

Impact

Successful exploitation allows unauthenticated attackers to perform SSRF and credential exfiltration via the Jolokia agent. Depending on the target's JVM configuration and available gadget chains, attackers may achieve remote code execution. This poses a significant risk to enterprise Java applications that utilize Jolokia for remote management, potentially leading to full compromise of the application server.

Recommendation

Prioritize the identification of all Jolokia instances within the network footprint. Monitor web server logs for POST requests containing target.url parameters. Audit the Jolokia configuration to ensure that the JSR-160 proxy is disabled if not required for business operations. Apply patches provided by the Jolokia project immediately upon release to address the validation logic flaw.