# CVE-2026-113730: OGNL Java reflection method invocation sandbox bypass

Source: https://junglewise.ai/threats/cve-2026-113730-ognl-is-an-object-graph-navigation-library-for-java-prior-to-3-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113730 · Severity: medium · CVSS 5.6 · Published 2026-10-20

OGNL is a Java library that evaluates dynamic expressions, commonly used in web frameworks to access object properties. The stricter-invocation sandbox mode, meant to prevent untrusted expressions from calling dangerous methods, can be bypassed by using Java reflection objects as proxies. An attacker who can provide expressions to an application relying on this sandbox for protection could invoke restricted operations like ProcessBuilder, potentially executing arbitrary code.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-113730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113730 being exploited in the wild.

**How severe is CVE-2026-113730?** Medium severity, with a CVSS score of 5.6, published 20 October 2026.

**Which products and versions are affected?** ognl:ognl (Maven) <= 3.4.12, ECOSYSTEM:introduced=0,fixed=3.4.13; OGNL prior to 3.4.13.

**Is there a fix for CVE-2026-113730?** Yes. ognl:ognl (Maven): upgrade to 3.4.13 or later. Until then: Use a restrictive MemberAccess configuration instead of relying on stricter-invocation mode alone; Apache Struts users should enable SecurityMemberAccess to block this and similar bypasses. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113730 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-113730?** Check whether you run ognl:ognl (Maven) or OGNL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ognl:ognl (Maven): upgrade to 3.4.13 or later

  ```sh
  # set ognl:ognl to 3.4.13 in your pom.xml or build.gradle
  ```


Use a restrictive MemberAccess configuration instead of relying on stricter-invocation mode alone; Apache Struts users should enable SecurityMemberAccess to block this and similar bypasses.

## Technical details

The vulnerability is a sandbox bypass in OgnlRuntime.invokeMethod's stricter-invocation mode. The blocklist checks the declaring class of invoked methods but excludes java.lang.reflect.Method, Constructor, and Field. An attacker can invoke these reflection objects to reach blocked classes (e.g., ProcessBuilder.start()), bypassing the check because the actual operation executes inside JDK reflection machinery without re-entering OGNL's security gate. Exploitation requires untrusted expression evaluation and permissive MemberAccess; applications using restrictive MemberAccess (like Apache Struts SecurityMemberAccess) are unaffected.

## Affected products

- OGNL OGNL prior to 3.4.13

## Identifiers

- CVE-2026-113730
- GHSA-crwc-vw2r-qr6m

## Timeline

- 2026-10-20: disclosed

## References

- [https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d](https://github.com/orphan-oss/ognl/commit/16396fa4b560221294c2ab9ca04b76b161115e7d)
- [https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2](https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2)

## Related threats

- [Denial of service in Apache Struts](https://junglewise.ai/threats/cve-2016-3093-denial-of-service-in-apache-struts)