CVE-2026-46495

CriticalCVSS 9.2

Published: 15/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Summary

OpenDJ prior to 5.1.1 processes attacker-controlled credential objects in the JMX RMI connector before authentication without a restrictive credentials filter pattern, and RmiAuthenticator accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution. The issue is fixed in 5.1.1.

Risk Assessment

Remote code execution in the OpenDJ server process without authentication is possible if the JMX handler is enabled and network-reachable. The handler is disabled by default, and exploitation depends on the runtime classpath and Java version.

Recommendation

Upgrade OpenDJ to version 5.1.1 or later. If the JMX Connection Handler is not needed, keep it disabled and restrict network access to JMX ports.

Other vulnerabilities in OpenDJ

CVE-2026-73644Critical
OpenDJ before 5.1.2 in the SASL PLAIN mechanism checks the PROXIED_AUTH privilege but does not evaluate the mayProxy proxy ACI scope when an authzid resolves to a different user. This allows an authenticated account with PROXIED_AUTH to assume any resolvable non-root identity outside the identities permitted by its proxy ACI. The fix returns INVALID_CREDENTIALS (49) before password verification when the target authorization identity is not permitted. This issue is fixed in version 5.1.2.

Original NVD description (English source)

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.