CVE-2026-91842 Overview
CVE-2026-91842 affects OpenBankProject OBP-API versions up to 1.10.1. The vulnerability resides in the KryoInjection.invert function within obp-api/src/main/scala/code/api/cache/Redis.scala, part of the Kryo Handler component. Manipulation of serialized input leads to insecure deserialization [CWE-20]. The flaw is remotely reachable but requires high attack complexity and high privileges, making practical exploitation difficult. A public exploit has been disclosed. The upstream project was notified through an issue report but has not responded at the time of publication.
Critical Impact
Authenticated remote attackers can submit crafted serialized payloads to the Kryo deserialization path, potentially compromising the confidentiality, integrity, and availability of the OBP-API service.
Affected Products
- OpenBankProject OBP-API versions up to and including 1.10.1
- Deployments using the Redis cache component that invokes KryoInjection.invert
- Environments exposing the OBP-API to authenticated network clients
Discovery Timeline
- 2026-09-15 - CVE-2026-91842 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91842
Vulnerability Analysis
The vulnerability is an insecure deserialization issue in the Kryo Handler used by OBP-API's Redis caching layer. The KryoInjection.invert function converts byte data back into Scala or Java objects without sufficient validation of the serialized input. An authenticated attacker who can influence data that reaches this deserialization path can supply crafted objects that trigger unintended object graphs on decode.
Exploitation requires network access, high privileges on the target, and high attack complexity. The public exploit disclosure raises the risk of opportunistic use, though the practical bar remains elevated. Because the deserialization path sits inside the caching layer, successful exploitation could affect cached banking API state and adjacent request-handling logic.
Root Cause
The root cause is improper input validation [CWE-20] during deserialization. Kryo, like other binary serialization libraries, will instantiate arbitrary registered classes from a byte stream. When the input is not constrained through a strict class allowlist or integrity check, an attacker who controls the bytes reaching KryoInjection.invert can drive object construction toward gadget chains present on the classpath.
Attack Vector
The attack vector is network-based and requires authenticated access with elevated privileges. An attacker crafts a serialized payload and steers it into the Redis-backed cache path so it is later processed by KryoInjection.invert. See the GitHub Security Advisory GHSA-889g and VulDB CVE-2026-91842 entry for further technical detail.
No verified proof-of-concept code is reproduced here. Refer to the GitHub Issue #2888 and the vendor repository at OpenBankProject OBP-API for source-level context on the affected function.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-91842
Indicators of Compromise
- Unexpected class instantiation or reflection activity originating from the OBP-API JVM process during cache read operations.
- Anomalous entries or oversized binary blobs written to Redis keys consumed by KryoInjection.invert.
- Application errors or exceptions referencing Kryo deserialization, unknown class registrations, or gadget-chain classes.
Detection Strategies
- Enable verbose logging on the Redis cache layer and audit for unauthorized writes to cache namespaces used by OBP-API.
- Monitor JVM behavior for unexpected process spawns, outbound connections, or file writes originating from the OBP-API application process.
- Correlate authenticated administrative activity against cache mutations to identify privileged accounts abusing deserialization paths.
Monitoring Recommendations
- Instrument the OBP-API service with runtime application monitoring to record deserialization events and class loading anomalies.
- Forward OBP-API, JVM, and Redis logs to a centralized analytics platform for correlation and long-term retention.
- Alert on new or unusual child processes of the OBP-API JVM, which are unexpected under normal operation.
How to Mitigate CVE-2026-91842
Immediate Actions Required
- Restrict network access to the OBP-API service and its Redis backend to trusted administrative networks only.
- Rotate and tighten credentials for accounts that hold high-privilege roles within OBP-API, since exploitation requires elevated privileges.
- Review and reduce the number of accounts with privileges that can influence cache content processed by KryoInjection.invert.
Patch Information
At the time of publication, no vendor patch has been referenced in the NVD entry. The upstream project was notified through GitHub Issue #2888 and the GitHub Security Advisory GHSA-889g but has not published a fix. Track the OpenBankProject repository for future releases beyond version 1.10.1.
Workarounds
- Isolate the Redis instance backing OBP-API on a private network and enforce authentication and TLS on Redis connections.
- Apply strict class allowlisting or replace Kryo-based caching with a safer serialization format such as JSON where feasible.
- Deploy a reverse proxy or web application firewall in front of OBP-API to constrain administrative endpoints and rate-limit privileged operations.
# Configuration example: restrict Redis network exposure
# /etc/redis/redis.conf
bind 127.0.0.1
protected-mode yes
requirepass <strong-random-secret>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
