CVE-2026-46495: OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/serv

Executive brief

OpenDJ is an open-source directory service used for managing user identities and access. A critical security flaw in its monitoring component allows an unauthenticated attacker to remotely take full control of the server. This could lead to the theft of sensitive identity data, service disruption, or further unauthorized access to the corporate network.

Technical details

A Deserialization of Untrusted Data (CWE-502) vulnerability exists in the OpenDJ JMX RMI connector. The root cause is the platform's processing of attacker-controlled bytes prior to the authentication phase. An unauthenticated remote attacker with TCP reachability to the JMX listener can trigger the deserialization of arbitrary Java objects. Successful exploitation leads to Remote Code Execution (RCE), the impact of which depends on the available classpath gadgets (e.g., Jackson). This issue is patched in version 5.1.1.

Affected products

• OpenIdentityPlatform OpenDJ Community Edition <= 5.1.0

Timeline

• 2026-06-20: disclosed
• 2026-06-22: advisory: GitHub Advisory published
• 2026-06-22: patched

References

• https://api.github.com/users/wodzen
• https://github.com/wodzen
• https://api.github.com/users/wodzen/gists%7B/gist_id%7D
• https://api.github.com/users/wodzen/repos
• https://avatars.githubusercontent.com/u/25558174?v=4
• https://api.github.com/users/wodzen/events%7B/privacy%7D