CVE-2026-113730: 
Java vulnerability analysis and mitigation

CVE-2026-113730 is a security feature bypass vulnerability in OGNL (Object Graph Navigation Library) for Java, specifically a stricter-invocation block list bypass via java.lang.reflect reflection proxies. It affects OGNL versions up to and including 3.4.12 (Maven artifact ognl:ognl), and was first published by the maintainer on September 11, 2026, with NVD publication on October 20, 2026. The vulnerability carries a CVSS v3.1 base score of 5.6 (Moderate) (GitHub Advisory).

The root cause is a Protection Mechanism Failure (CWE-693) in OgnlRuntime.invokeMethod: the optional stricter-invocation mode maintains a block list of dangerous classes (e.g., Runtime, ProcessBuilder, ClassLoader) but omitted java.lang.reflect.Method, java.lang.reflect.Constructor, and java.lang.reflect.Field. An attacker-controlled OGNL expression can obtain a Method object for a blocked class's method and call Method.invoke() on it; the actual operation then executes inside JDK reflection machinery without re-entering OGNL's invokeMethod, so the block list check is never applied to the real call. Exploitation requires three conditions: (1) the application evaluates untrusted OGNL expressions, (2) it uses the default or equivalently permissive MemberAccess that allows java.lang.reflect, and (3) it relies on stricter-invocation mode as its sandbox. A published proof-of-concept in the advisory demonstrates creating a file via ProcessBuilder.start() using this reflection proxy technique (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to bypass the stricter-invocation sandbox and execute arbitrary methods on blocked classes, potentially achieving arbitrary OS command execution (as demonstrated by the ProcessBuilder PoC), unauthorized data access, or modification of application state. The impact is limited to low confidentiality, integrity, and availability effects per CVSS scoring, reflecting that this is a bypass of a secondary defense-in-depth layer rather than OGNL's primary security boundary. Applications using a restrictive MemberAccess (such as Apache Struts with SecurityMemberAccess) are not affected, significantly narrowing the scope of vulnerable deployments (GitHub Advisory).

A proof-of-concept OGNL expression is publicly documented in the official security advisory, demonstrating file creation via ProcessBuilder reflection proxy. As of the time of disclosure, there is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.358%, indicating a low probability of exploitation in the near term. NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a Java application that evaluates untrusted OGNL expressions, uses OGNL ≤ 3.4.12 with the default permissive MemberAccess, and relies on stricter-invocation mode as its sandbox (not SecurityMemberAccess or equivalent).
2. Craft a reflection-proxy OGNL expression: Construct an expression that obtains a java.lang.reflect.Method object for a method on a blocked class (e.g., ProcessBuilder.start()), bypassing the block list check:

(#pb=new java.lang.ProcessBuilder({"/usr/bin/touch","rce-proof.txt"}),
 #methods=@java.lang.ProcessBuilder@class.getMethods(),
 #names=#methods.{ #this.getName() },
 #startIdx=#names.indexOf("start"),
 #methods[#startIdx].invoke(#pb, null))

3. Submit the expression: Inject the crafted OGNL expression through any application input point that is evaluated server-side (e.g., HTTP parameter, template field, or API endpoint).
4. Achieve sandbox bypass: The Method.invoke() call executes ProcessBuilder.start() inside JDK reflection without re-entering OGNL's invokeMethod, so the block list never intercepts the real operation, resulting in OS command execution or other blocked actions (GitHub Advisory).

• Logs: Application logs showing OGNL expression evaluation containing java.lang.reflect.Method, Constructor, or Field class references alongside blocked class names (e.g., ProcessBuilder, Runtime); unexpected IllegalAccessException stack traces from OgnlRuntime.invokeMethod in pre-patch versions.
• File System: Unexpected files created by the application server process (e.g., rce-proof.txt or similar artifacts in writable directories), or new scripts/executables in application directories.
• Process: Unusual child processes spawned by the Java application server process (e.g., /bin/sh, /usr/bin/touch, curl, wget) that are not part of normal application behavior.
• Network: Outbound connections from the application server to unexpected external hosts, potentially indicating reverse shell or data exfiltration activity following exploitation.

Upgrade OGNL to version 3.4.13 or later, which adds java.lang.reflect.Method, java.lang.reflect.Constructor, and java.lang.reflect.Field to the stricter-invocation block list (OGNL Release). As a workaround, configure a restrictive MemberAccess implementation (such as Apache Struts' SecurityMemberAccess) that blocks access to java.lang.reflect classes, which prevents the bypass at the primary access-control gate. Additionally, disable evaluation of untrusted OGNL expressions wherever possible to eliminate the attack surface entirely (GitHub Advisory).

The vulnerability was responsibly disclosed through Tidelift by researcher 毛锐 (youyi.mr@alibaba-inc.com) and published by OGNL maintainer lukaszlenart. The advisory explicitly frames this as a hardening of a defense-in-depth secondary layer rather than a primary security boundary break, and notes that properly configured consumers such as Apache Struts are unaffected — a nuance that has been highlighted in the advisory text to prevent unnecessary alarm (GitHub Advisory).