CVE-2026-50633: Apache CXF JNDI Injection RCE Vulnerability

CVE-2026-50633 Overview

CVE-2026-50633 is a Java Naming and Directory Interface (JNDI) Injection vulnerability in the Apache CXF JCA integration module. Attackers who can manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters can trigger code execution in the host process. The flaw maps to [CWE-20] improper input validation of JNDI-bound names supplied through JCA configuration. Apache published the advisory on the project mailing list and released fixed versions 4.2.2 and 4.1.7. The vulnerability affects deployments where Apache CXF is integrated through the Java EE Connector Architecture (JCA) and where deployment descriptors can be influenced by untrusted parties.

Critical Impact
Successful exploitation allows arbitrary code execution in the Apache CXF JCA runtime, compromising confidentiality, integrity, and availability of the affected Java application server.

Affected Products

Apache CXF versions prior to 4.2.2 (4.2.x branch)
Apache CXF versions prior to 4.1.7 (4.1.x branch)
Java EE application servers using the Apache CXF JCA integration module

Discovery Timeline

2026-06-12 - CVE-2026-50633 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50633

Vulnerability Analysis

Apache CXF is a widely deployed open-source services framework for building SOAP and REST APIs on the Java Virtual Machine (JVM). Its JCA integration module exposes CXF services through the Java EE Connector Architecture, which uses an ra.xml deployment descriptor to declare connection factories and activation specifications.

The vulnerable code path consumes values from ra.xml or runtime activation parameters and passes them into a JNDI lookup without validating the resulting name or scheme. An attacker who can write or modify these configuration values can supply a remote JNDI URI such as an ldap:// or rmi:// reference. When the resource adapter activates, the lookup resolves the attacker-controlled reference and the JVM loads and instantiates the returned object, leading to arbitrary code execution.

This vulnerability class mirrors the JNDI injection patterns made prominent by Log4Shell. Exploitation does require the ability to influence deployment configuration, which raises attack complexity but does not require privileges or user interaction at runtime.

Root Cause

The root cause is unvalidated input flowing into a JNDI Context.lookup() operation inside the JCA resource adapter activation logic. The module trusts deployment descriptor values as administrator-supplied data and performs no allow-list filtering on JNDI schemes or remote references. The fix in 4.2.2 and 4.1.7 constrains the lookup behavior and rejects untrusted remote references.

Attack Vector

The attack vector is network-reachable but indirect. An attacker must first place a malicious JNDI URI inside ra.xml or pass it through runtime activation parameters. This is feasible when build pipelines, configuration repositories, or management interfaces accept tenant-supplied or unreviewed JCA descriptors. Once the resource adapter is deployed, CXF performs the JNDI lookup against the attacker-controlled endpoint, fetches a serialized object or remote class reference, and executes it inside the application server JVM.

No verified proof-of-concept code is publicly available. See the Apache Mailing List Post for vendor technical details.

Detection Methods for CVE-2026-50633

Indicators of Compromise

Outbound LDAP, LDAPS, RMI, or DNS connections originating from the Java application server hosting Apache CXF, particularly to untrusted external hosts.
ra.xml files containing JNDI references with schemes such as ldap://, rmi://, or iiop:// pointing to non-local hosts.
Unexpected child processes spawned by the application server JVM following resource adapter deployment or redeployment.

Detection Strategies

Inventory all running Apache CXF instances and compare versions against the fixed releases 4.2.2 and 4.1.7.
Scan source control and artifact repositories for ra.xml files and review JNDI-bound values for remote URIs.
Hunt application server logs for JNDI lookup failures or class-loading events associated with the CXF JCA adapter.

Monitoring Recommendations

Alert on any egress traffic from Java application server hosts to LDAP (389/636) or RMI (1099) endpoints outside approved directories.
Monitor file integrity on JCA deployment descriptors and resource adapter archives (.rar).
Track JVM process trees for execution of shells, curl, wget, or scripting interpreters launched from application server processes.

How to Mitigate CVE-2026-50633

Immediate Actions Required

Upgrade Apache CXF to version 4.2.2 or 4.1.7 on all affected deployments.
Audit every ra.xml deployment descriptor and runtime activation parameter set for untrusted JNDI references.
Restrict write access to JCA configuration artifacts to a minimal set of trusted administrators and pipelines.

Patch Information

The Apache CXF project addressed CVE-2026-50633 in versions 4.2.2 and 4.1.7. Refer to the Apache Mailing List Post and the Openwall OSS Security Update for release details and upstream commit references.

Workarounds

Set the JVM property com.sun.jndi.ldap.object.trustURLCodebase=false and com.sun.jndi.rmi.object.trustURLCodebase=false to block remote codebase loading via JNDI.
Block outbound LDAP, RMI, and IIOP connections from application server hosts at the network boundary.
Where upgrade is not yet feasible, disable the Apache CXF JCA integration module if it is not required by the application.

bash

# Configuration example - JVM flags to mitigate JNDI remote codebase loading
JAVA_OPTS="$JAVA_OPTS \
  -Dcom.sun.jndi.ldap.object.trustURLCodebase=false \
  -Dcom.sun.jndi.rmi.object.trustURLCodebase=false \
  -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false"