CVE-2026-67615: openEQUELLA RCE Vulnerability

CVE-2026-67615 Overview

CVE-2026-67615 is an authenticated remote code execution vulnerability in openEQUELLA versions before 2026.1.0. The flaw resides in the HTTP invoker endpoint at /invoker/* and stems from unsafe Java deserialization. Any authenticated non-guest user can exploit this issue to execute arbitrary code on the server. Attackers bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject. The nested payload is deserialized by a separate ObjectInputStream that does not apply the denylist, reaching a Java Naming and Directory Interface (JNDI) sink.

Critical Impact

Authenticated attackers can achieve arbitrary code execution on openEQUELLA servers, leading to full compromise of the application host and any stored learning content [CWE-184].

Affected Products

• openEQUELLA versions prior to 2026.1.0
• Deployments exposing the /invoker/* HTTP endpoint
• Any openEQUELLA instance with non-guest user accounts

Discovery Timeline

• 2026-09-22 - CVE-2026-67615 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-67615

Vulnerability Analysis

The vulnerability targets the Spring HTTP invoker endpoint exposed at /invoker/* in openEQUELLA. This endpoint accepts serialized Java objects from authenticated clients and deserializes them server-side. To mitigate deserialization risk, openEQUELLA implements PluginAwareObjectInputStream, which enforces a denylist of dangerous class names during resolveClass calls.

The denylist protection is bypassed through nested deserialization. An attacker wraps a malicious payload inside a java.security.SignedObject, which is itself allowed by the filter. When SignedObject.getObject() is invoked during processing, it constructs a new ObjectInputStream internally that does not inherit the denylist filtering logic. The inner stream then deserializes gadget chains without restriction. This chain terminates at a JNDI lookup sink, enabling remote class loading and code execution on the openEQUELLA host.

Root Cause

The root cause is an incomplete denylist [CWE-184] applied only at the outer deserialization layer. PluginAwareObjectInputStream filters classes it directly resolves, but does not propagate its filtering to secondary ObjectInputStream instances created by allowed classes such as SignedObject. This trust boundary gap enables the bypass.

Attack Vector

An attacker authenticates to openEQUELLA using any non-guest account. The attacker then sends a crafted HTTP POST request to a /invoker/* endpoint containing a serialized SignedObject that wraps a JNDI gadget payload. The server deserializes the outer wrapper, invokes the inner stream, and triggers the JNDI lookup. The lookup resolves against an attacker-controlled server, loading a remote class and executing code within the openEQUELLA process context.

A detailed technical writeup is available in Evan's Blog on openEQUELLA and the VulnCheck openEQUELLA RCE Advisory.

Detection Methods for CVE-2026-67615

Indicators of Compromise

• Unexpected HTTP POST requests to /invoker/* paths containing serialized Java payloads (magic bytes AC ED 00 05).
• Outbound LDAP, RMI, or DNS connections from the openEQUELLA Java process to unfamiliar hosts, consistent with JNDI resolution.
• Child processes spawned by the openEQUELLA application server that fall outside normal operational baselines.
• Java stack traces in application logs referencing SignedObject, PluginAwareObjectInputStream, or InitialContext.lookup.

Detection Strategies

• Inspect web access logs for authenticated POST /invoker/* requests and correlate with user session activity.
• Deploy network monitoring to identify JNDI-related egress traffic originating from the application server.
• Enable Java security manager or deserialization instrumentation to log class resolution events on the HTTP invoker.

Monitoring Recommendations

• Alert on any process execution originating from the openEQUELLA Java Virtual Machine (JVM), such as sh, bash, cmd.exe, or powershell.exe.
• Monitor authentication logs for newly created or rarely used non-guest accounts issuing invoker traffic.
• Track outbound connections on ports 389, 636, and 1099 from application servers hosting openEQUELLA.

How to Mitigate CVE-2026-67615

Immediate Actions Required

• Upgrade openEQUELLA to version 2026.1.0 or later as published in the GitHub openEQUELLA Release 2026.1.0.
• Restrict network access to the /invoker/* endpoint using reverse proxy rules or firewall ACLs where the endpoint is not required.
• Audit user accounts and remove or disable non-guest accounts that are no longer needed.
• Review web server and application logs for prior exploitation attempts targeting /invoker/*.

Patch Information

The openEQUELLA maintainers fixed this issue in release 2026.1.0. Administrators should follow the upgrade documentation provided with the release. Refer to the GitHub openEQUELLA Release 2026.1.0 notes for upgrade procedures and validation steps.

Workarounds

• Block external access to the /invoker/* URL path at the reverse proxy or load balancer layer if HTTP invoker functionality is not in use.
• Enforce strong authentication and rotate credentials for all non-guest accounts to reduce the attacker pool.
• Deploy Java Virtual Machine flags such as -Dcom.sun.jndi.ldap.object.trustURLCodebase=false and -Dcom.sun.jndi.rmi.object.trustURLCodebase=false to limit JNDI remote class loading.
• Isolate the openEQUELLA host in a segmented network zone with strict egress filtering to prevent JNDI callbacks.

# Example nginx configuration to block the vulnerable endpoint
location ~ ^/invoker/ {
    deny all;
    return 403;
}