{"id":"CVE-2026-46495","summary":"OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI","details":"OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential objects before authentication without a restrictive jmx.remote.rmi.server.credentials.filter.pattern, and RmiAuthenticator.authenticate in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java accepts an unconstrained Object array rather than a two-element String[]. When the JMX Connection Handler is enabled and its TCP listener is reachable, an unauthenticated remote attacker can submit a crafted serialized Java object and achieve code execution in the OpenDJ server process. The handler is disabled by default, and successful exploitation depends on the runtime classpath and Java version; remote code execution was demonstrated against OpenDJ 4.4.15 on JDK 11 with Jackson 2.12.6.1. This issue is fixed in 5.1.1.","aliases":["GHSA-43x2-g84q-fmqx"],"modified":"2026-09-17T08:08:34.129196Z","published":"2026-09-15T14:09:30.669Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46495.json"},"references":[{"type":"WEB","url":"https://github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46495.json"},{"type":"ADVISORY","url":"https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-43x2-g84q-fmqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46495"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenDJ/commit/7e3a75903159153c877daeb2952a552701e38044"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenDJ/commit/d4a95c2e37c375756f9829c7ec43a4785b99e2e2"},{"type":"FIX","url":"https://github.com/OpenIdentityPlatform/OpenDJ/pull/651"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openidentityplatform/opendj","events":[{"introduced":"0"},{"fixed":"7e3a75903159153c877daeb2952a552701e38044"},{"fixed":"d4a95c2e37c375756f9829c7ec43a4785b99e2e2"},{"fixed":"eefd084c464aaa6492814a833d804a93e2001782"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["5.1.0","5.0.4","5.0.3","5.0.2","5.0.1","4.10.2","4.10.1","4.10.0","4.9.4","4.9.3","4.9.2","4.9.1","4.9.0","4.8.2","4.8.1","4.8.0","4.7.0","4.6.5","4.6.4","4.6.3","4.6.2","4.6.1","4.5.9","4.5.6","4.5.5","4.5.4","4.5.3","4.5.1","4.5.0","4.4.15","4.4.14","4.4.13","4.4.12","4.4.11","4.4.10","4.4.9","4.4.8","4.4.7","4.4.6","4.4.5","4.4.4","4.4.3","4.4.2","4.4.1","4.3.5","4.3.4","4.3.3","4.3.2","4.3.1","4.2.5","4.2.4","4.2.3","4.2.2","4.2.1","4.1.10","4.1.9","4.1.6","4.0.3","4.0.2","4.0.1","4.0.0-M1","3.0.0-M7","3.0.0-M6","3.0.0-M5","3.0.0-M4","last-common-commit-with-opendj-sdk-repo"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46495.json","vanir_signatures_modified":"2026-09-17T08:08:34Z","vanir_signatures":[{"source":"https://github.com/openidentityplatform/opendj/commit/7e3a75903159153c877daeb2952a552701e38044","target":{"file":"opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java","function":"startConnectorNoClientCertificate"},"deprecated":false,"digest":{"function_hash":"36407201546634784427645062051310184095","length":2069},"id":"CVE-2026-46495-289c22e5","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["64586167768530570497443340195331387948","309135930679493243099863335248265709334","83311996734116052513480001760175851028","250048944781251554484278583814387456447","209552502908494282430921694279792265255","36360066001077380863961721751014650937","174805788874261827730489689761132290693"]},"id":"CVE-2026-46495-b5501de5","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/opendj/commit/7e3a75903159153c877daeb2952a552701e38044","target":{"file":"opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["81301260170667640408244650093825832332","275073423430940816573792100850871355509","291870225912243916883157988993777072518","322828525029929297358113160596376708615","221035825010141613756163036749559460690","4278575887053374902045850810598669321","306634615852389220860485024370666886892","297052365731015183020400195020896951862","27888637926161021378951924380460258388","319879834322167055555774346236854025238","177322192247642510759811890504664848634","186730558156324376204308530437733635844","12075235626216775358342912458086137238","184553741772770012557724427095331561978","60595433410401980272310979351743253666"],"threshold":0.9},"id":"CVE-2026-46495-bd18874a","signature_type":"Line","signature_version":"v1","source":"https://github.com/openidentityplatform/opendj/commit/7e3a75903159153c877daeb2952a552701e38044","target":{"file":"opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java"}},{"signature_version":"v1","source":"https://github.com/openidentityplatform/opendj/commit/7e3a75903159153c877daeb2952a552701e38044","target":{"file":"opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiAuthenticator.java","function":"authenticate"},"deprecated":false,"digest":{"function_hash":"113470039159357384789318273884520605464","length":1122},"id":"CVE-2026-46495-f230cf9b","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}