Summary

The CVE-2026-46495 fix scoped its JEP 290 deserialization filter to the JMX authentication credentials only (jmx.remote.rmi.server.credentials.filter.pattern). No connector-wide jmx.remote.rmi.server.serial.filter.pattern and no JVM-wide jdk.serialFilter are configured. As a result, once a client authenticates, the arguments of MBean operations (the Object[] params of invoke()) are unmarshalled by the JMX/RMI server with no serial filter at all.

Impact

An authenticated directory user holding the JMX_READ privilege, on a deployment where the JMX connection handler is enabled, can drive native Java deserialization of arbitrary object graphs through MBean operation arguments. With a suitable gadget on the server classpath this can lead to RCE; absent a gadget it is still an unrestricted-deserialization sink (DoS via resource-exhausting graphs). It is the post-authentication continuation of CVE-2026-46495, which closed only the pre-auth credentials slot.

Preconditions

• JMX connection handler is disabled by default.
• Requires valid credentials and the JMX_READ privilege (not anonymous, unlike the original CVE).
• RCE is gadget-dependent.

Remediation

Install the connector-wide jmx.remote.rmi.server.serial.filter.pattern alongside the credentials filter, allowlisting only the JDK / JMX management types OpenDJ accepts as MBean operation arguments and attribute values, and rejecting everything else with a trailing !*:

maxdepth=20;java.lang.*;java.math.BigInteger;java.math.BigDecimal;java.util.*;javax.management.*;javax.management.openmbean.*;!*