CVE-2026-84218: Incomplete List of Disallowed Inputs in Red Hat Red Hat AMQ Broker 7

The vulnerability arises from Jolokia's JSR-160 proxy accepting a `target.url` parameter from POST requests without sufficiently validating it against all disallowed URL forms. The existing denylist only blocks URLs matching `service:jmx:rmi:///jndi/ldap:.*`, but attackers can bypass this by using alternative valid JMX service URLs like ldaps:// or LDAP URLs with a non-empty JMX host component. These URLs are accepted as valid by `JMXServiceURL` and `JMXConnectorFactory`, causing the Jolokia agent JVM to perform JNDI lookups against attacker-controlled LDAP endpoints. This can lead to SSRF, forwarding of JMX credentials, and potentially remote code execution depending on the JVM's classes and configuration.

Successful exploitation can result in server-side request forgery (SSRF), unauthorized forwarding of JMX credentials to attacker-controlled LDAP endpoints, and potentially remote code execution on the target JVM. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but high attack complexity.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84218 for current remediation guidance. Until an official fix is available, restrict network access to the Jolokia JMX proxy and monitor for suspicious JNDI lookup activity. Avoid exposing Jolokia endpoints to untrusted networks.