OGNL stricter-invocation check bypassed via java.lang.reflect proxies
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.
Summary
OGNL before 3.4.13 (Maven ognl:ognl from 0 before 3.4.13) has a protection mechanism failure (CWE-693) in its optional stricter-invocation mode. The check in OgnlRuntime.invokeMethod validates only the declaring class of invoked methods and does not block java.lang.reflect.Method, Constructor, or Field, so reflection objects can run operations on blocked classes. An attacker who can supply an OGNL expression can exploit this in an application that evaluates untrusted expressions, uses the default or a permissive MemberAccess, and relies on stricter invocation as a sandbox. Apache Struts with SecurityMemberAccess is not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| orphan-oss | ognl | before 3.4.13 | 3.4.13 | Patch available | CNA |
| — | ognl:ognl (Maven) | before 3.4.13 | 3.4.13 | Patch available | GHSA-crwc-vw2r-qr6m |
- ognl Vendororphan-oss Affected before 3.4.13 Fixed in 3.4.13 Patch available CNA
- ognl:ognl (Maven) Vendor— Affected before 3.4.13 Fixed in 3.4.13 Patch available GHSA-crwc-vw2r-qr6m
Remediation
Update OGNL to version 3.4.13, which fixes this issue. Red Hat lists Red Hat Fuse 7 as affected with no fix planned.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA ognl (orphan-oss) Fixed in 3.4.13
- Fix · GHSA-crwc-vw2r-qr6m ognl:ognl (Maven) Fixed in 3.4.13 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-21 Threatist record created from CVE-2026-113730
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: MEDIUM → LOW
- 2026-10-21 Alias added: GHSA-crwc-vw2r-qr6m
- 2026-10-21 Fix available: Maven/ognl:[email protected] · GHSA-crwc-vw2r-qr6m
- 2026-10-21 CVSS score added · GHSA-crwc-vw2r-qr6m
- 2026-10-21 Weakness changed · GHSA-crwc-vw2r-qr6m
- 2026-10-21 6 new references · GHSA-crwc-vw2r-qr6m
- 2026-11-02 CVSS score changed · GHSA-crwc-vw2r-qr6m
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-03 CVSS score added · Red Hat
References
Other 5
- https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m
- https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d
- https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2
- https://github.com/orphan-oss/ognl/releases/tag/OGNL_3_4_13
- https://github.com/orphan-oss/ognl
Sources
- CVE-2026-113730 · CVE Program
- CVE-2026-113730 · NVD
- FIRST EPSS
- GHSA-crwc-vw2r-qr6m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-113730 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences