Read the docs
TI-2026-34193 Aliases CVE-2026-46495GHSA-43x2-g84q-fmqx

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

Priority MEDIUM 44CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01131 66th percentileScored 2026-11-07
Fix Fixed OpenDJ (OpenIdentityPlatform): 5.1.1opendj-server-legacy (org.openidentityplatform.opendj): 5.1.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenIdentityPlatformOpenDJbefore 5.1.15.1.1Patch availableCNA
org.openidentityplatform.opendjopendj-server-legacybefore 5.1.15.1.1Patch availableCNA
—org.openidentityplatform.opendj:opendj-server-legacy (Maven)before 5.1.15.1.1Patch availableGHSA-43x2-g84q-fmqx
  • OpenDJ VendorOpenIdentityPlatform Affected before 5.1.1 Fixed in 5.1.1 Patch available CNA
  • opendj-server-legacy Vendororg.openidentityplatform.opendj Affected before 5.1.1 Fixed in 5.1.1 Patch available CNA
  • org.openidentityplatform.opendj:opendj-server-legacy (Maven) Vendor— Affected before 5.1.1 Fixed in 5.1.1 Patch available GHSA-43x2-g84q-fmqx

Remediation

  • Fix · CNA OpenDJ (OpenIdentityPlatform) Fixed in 5.1.1
  • Fix · CNA opendj-server-legacy (org.openidentityplatform.opendj) Fixed in 5.1.1
  • Fix · GHSA-43x2-g84q-fmqx org.openidentityplatform.opendj:opendj-server-legacy (Maven) Fixed in 5.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46495
  2. 2026-10-03 Alias added: GHSA-43x2-g84q-fmqx

References

Other 6

  • TI-2025-20332 OpenDJ Denial of Service (Dos) using alias loop CVSS 4.0HIGH 8.7
  • TI-2026-25836 Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM CVSS 4.0CRITICAL 9.3
  • TI-2026-86693 Session token disclosure in OpenAM notification WebSocket CVSS 4.0CRITICAL 10.0
  • TI-2026-86692 Authentication bypass in OpenAM SAML login accepts unsigned assertions CVSS 4.0CRITICAL 9.3
  • TI-2026-86691 Privilege escalation in OpenAM via self-registration attribute bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-86685 Unbounded Java deserialization in OpenAM enables denial of service CVSS 4.0HIGH 8.7
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences