CVE-2026-47424: OpenAM Sandbox Escape RCE Vulnerability

CVE-2026-47424 Overview

Open Access Management (OpenAM) is an open-source access management platform maintained by the Open Identity Platform. Versions prior to 16.1.1 contain a sandbox escape in the GroovySandboxValueFilter component. An authenticated script author can bypass the default class allow and deny lists and execute operating system commands as the OpenAM application server account.

The flaw enables a sub-realm RealmAdmin to cross the realm-scoped administration boundary. Successful exploitation compromises the Java Virtual Machine (JVM) and every realm the OpenAM instance serves. The issue is tracked under [CWE-693] Protection Mechanism Failure and is fixed in version 16.1.1.

Critical Impact

An authenticated realm administrator can escape the Groovy scripting sandbox to achieve remote code execution as the OpenAM service account, breaking multi-tenant isolation across all realms hosted by the JVM.

Affected Products

• Open Identity Platform OpenAM versions prior to 16.1.1
• OpenAM deployments using the openam-scripting module with Groovy engine enabled
• Multi-realm OpenAM tenants where sub-realm administrators can author or edit server-side scripts

Discovery Timeline

• 2026-09-15 - CVE-2026-47424 published to the National Vulnerability Database (NVD)
• 2026-09-15 - Last updated in NVD database
• Fix released - Open Identity Platform published OpenAM Release 16.1.1 with the patched GroovySandboxValueFilter

Technical Details for CVE-2026-47424

Vulnerability Analysis

OpenAM exposes a scripting subsystem that allows administrators to author Groovy scripts for authentication modules, policy conditions, and OAuth2 flows. The GroovySandboxValueFilter class is intended to enforce a security boundary by consulting class allow and deny lists before permitting access to any object or method invocation at runtime.

The filter's logic does not fully validate values returned from sandboxed script execution. An authenticated script author can craft Groovy expressions that reach classes or reflective operations outside the intended list. Once the filter is bypassed, standard Java runtime facilities such as Runtime.exec() or ProcessBuilder become reachable from the executed script.

Because script execution runs inside the OpenAM JVM, code executes with the privileges of the application server account. The realm-scoped administration boundary is enforced at the OpenAM object layer and does not survive an escape to the JVM. A RealmAdmin in one sub-realm can therefore read secrets, modify policies, or extract session material for every other realm served by the same instance.

Root Cause

The root cause is an incomplete protection mechanism in openam-scripting/src/main/java/org/forgerock/openam/scripting/sandbox/GroovySandboxValueFilter.java. The filter relies on class deny and allow lists that do not cover every path a Groovy script can use to reach sensitive runtime APIs, satisfying [CWE-693].

Attack Vector

Exploitation requires network access to the OpenAM administrative console and authenticated credentials with script authoring rights, such as a sub-realm RealmAdmin. The attacker creates or edits a Groovy script bound to an executable context, then triggers evaluation to run arbitrary shell commands on the underlying host.

// Patch header from openam-scripting/src/main/java/org/forgerock/openam/scripting/sandbox/GroovySandboxValueFilter.java
 * information: "Portions copyright [year] [name of copyright owner]".
 *
 * Copyright 2014-2015 ForgeRock AS.
+ * Portions copyright 2026 3A Systems,LLC
+ * Portions Copyrighted 2026 OSSTech Corporation
 */

package org.forgerock.openam.scripting.sandbox;

Source: GitHub Commit 5c843cc. The commit tightens value filtering in the Groovy sandbox to prevent authenticated script authors from reaching disallowed classes.

Detection Methods for CVE-2026-47424

Indicators of Compromise

• Creation or modification of Groovy scripts by sub-realm administrators immediately followed by script execution events in OpenAM audit logs
• OpenAM Java process (java) spawning unexpected child processes such as /bin/sh, bash, cmd.exe, powershell.exe, curl, or wget
• Outbound network connections from the OpenAM host to unrecognized IP addresses shortly after script edits
• New or modified files under the OpenAM home directory or /tmp created by the application server account

Detection Strategies

• Alert on any child process spawned by the OpenAM JVM. Legitimate OpenAM operation rarely requires shell subprocesses.
• Correlate OpenAM audit events for SCRIPT_CREATED and SCRIPT_UPDATED with process creation telemetry on the host within a short time window.
• Baseline the set of script authors per realm and flag scripts authored by accounts that have not previously used the scripting subsystem.

Monitoring Recommendations

• Forward OpenAM audit logs and host process telemetry into a central analytics pipeline for cross-source correlation.
• Monitor the OpenAM installation directory and configuration store for unauthorized changes to scripts and policy bindings.
• Track authentication and role assignment events that grant RealmAdmin or script authoring privileges in any sub-realm.

How to Mitigate CVE-2026-47424

Immediate Actions Required

• Upgrade OpenAM to version 16.1.1 or later on all instances that expose the scripting subsystem.
• Audit every realm for accounts that hold script creation or edit permissions and remove privileges that are not operationally required.
• Review OpenAM audit logs for script create and update events since the earliest deployment of an affected version and investigate any that cannot be attributed to a change ticket.

Patch Information

The fix is available in OpenAM Release 16.1.1. The corrective change to GroovySandboxValueFilter is documented in GitHub Commit 5c843cc and further described in GitHub Security Advisory GHSA-69j4-qvqr-hpw3.

Workarounds

• Disable the Groovy scripting engine in OpenAM if scripts are not required by production workflows.
• Restrict script authoring capability to a small set of top-level administrators and prohibit RealmAdmin roles in sub-realms from editing scripts.
• Run the OpenAM application server under a dedicated low-privilege OS account with restricted filesystem and network access to reduce post-exploit impact.

# Verify the deployed OpenAM version and confirm the fix is present
curl -s https://openam.example.com/openam/json/serverinfo/version | jq .

# Expected: version reported as 16.1.1 or later