A flaw in Jolokia’s JSR‑160 proxy allows an attacker to supply a client‑controlled JMX service URL that bypasses the denylist designed to block LDAP access. The proxy records the target URL from a POST request and forwards it to JMXServiceURL and JMXConnectorFactory for a remote connection. Because the denylist only rejects URLs matching the pattern service:jmx:rmi:///jndi/ldap:.*, attackers can use alternative service URLs such as ldaps:// or LDAP URLs with a non‑empty JMX host component. These URLs are accepted as valid JMXServiceURL objects, causing the Jolokia agent JVM to perform a JNDI lookup against an attacker‑controlled LDAP endpoint. The result is a server‑side request forgery that can forward supplied JMX credentials and, depending on the classes and configuration available in the target JVM, can lead to remote code execution. This vulnerability corresponds to CWE‑184, a flaw in validation of external input.

Red Hat Fuse 7, Red Hat Satellite 6, Red Hat build of Apache Camel 4 for Quarkus 3, and Red Hat build of Apache Camel for Spring Boot 4 are affected. No specific vulnerable versions are listed in the CNA data, so any installation that includes Jolokia JSR‑160 proxy functionality is potentially impacted.

The CVSS score of 8.1 indicates high severity. EPSS is not available, but the vulnerability is not listed in CISA KEV, suggesting no public exploit has been published. The likely attack vector is a crafted POST request to the Jolokia endpoint that sets target.url to an attacker‑controlled JMX service URL, enabling the server to reach an external LDAP or LDAPS server. Successful exploitation requires that the Jolokia agent is reachable by the attacker and that the target JVM has the necessary classes to allow code execution. Given the severity and the possibility of remote code execution, the risk to systems that expose Jolokia without mitigation is high.