5.6

CVE-2026-113730: OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

Received
AliasesGHSA-crwc-vw2r-qr6mCGA-cvg8-rq7c-qw6vCGA-r8rj-hq36-5g2q
Published 20-10-2026Last modified 21-10-2026

Vulnerability summary

CVE-2026-113730 is a medium (CVSS 5.6) Protection Mechanism Failure vulnerability in orphan-oss ognl. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.6/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.36%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Timeline

  1. 20-10-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

21-10-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard15 products
  • camunda-8.10All versions (No fix recorded)
  • camunda-8.8All versions (No fix recorded)
  • camunda-8.9All versions (No fix recorded)
  • camunda-zeebe-8.10All versions (No fix recorded)
  • camunda-zeebe-8.6All versions (No fix recorded)
Wolfi3 products
  • celeborn-0.6All versions (No fix recorded)
  • sonarqubeAll versions (No fix recorded)
  • thingsboard-tb-nodeAll versions (No fix recorded) | < 4.4-r6
Ognl1 product
  • ognl< 3.4.13
Orphan-oss1 product

4 vendors · 20 products

References

7 links