CVE-2018-1000130: Jolokia agent JNDI injection in proxy mode enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with a very high EPSS score, tempered only by the AC:H condition and lack of KEV listing.

What it is

Jolokia agent 1.3.7 contains a JNDI injection flaw in its proxy mode that lets a remote attacker execute arbitrary Java code on the server. Because the agent is typically deployed to expose JMX over HTTP, a successful hit gives full control of the JVM and its host context. The record names only version 1.3.7, so other versions cannot be confirmed as affected from this data.

Impact

An attacker can run arbitrary Java code in the Jolokia agent's JVM, leading to full compromise of the application and potentially the underlying host. No privilege escalation step is described; code execution is the direct outcome.

Attack surface

Reachable over the network via the agent's HTTP interface when proxy mode is enabled, per the CVSS vector AV:N/PR:N/UI:N. No authentication or user interaction is required, though the AC:H rating indicates exploitation depends on specific conditions such as a reachable JNDI lookup target.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.727 (99.4th percentile), indicating strong likelihood of exploitation activity. References are vendor and Red Hat advisories only, with no public exploit tag supplied.

What to do

• Upgrade Jolokia to 1.5.0 or later, which the vendor release notes list as containing the security fix.
• Apply the Red Hat errata RHSA-2018:2669 if running the affected Red Hat-packaged component.
• Disable proxy mode where it is not operationally required, and restrict agent HTTP access to trusted networks.
• Block or filter outbound and inbound JNDI/LDAP/RMI traffic from hosts running the agent to break the injection path.

Detection

• Monitor Jolokia agent HTTP requests for proxy-mode calls containing JNDI or LDAP/RMI lookup strings.
• Alert on unexpected outbound LDAP, RMI or DNS traffic originating from JVMs running the Jolokia agent.
• Audit deployed Jolokia versions and flag any instance still on 1.3.7 or below the fixed 1.5.0 release.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.