CVE-2026-94301: Apache MINA Auth Bypass Vulnerability

CVE-2026-94301 Overview

CVE-2026-94301 is a critical deserialization vulnerability in Apache MINA affecting the 2.0.x and 2.1.x maintenance branches. The prior fix for CVE-2026-47065, which added a resolveProxyClass() override to enforce the acceptMatchers allow-list, was committed only to the 2.2.x branch. Releases 2.0.29, 2.1.13, and every later version through 2.0.30 and 2.1.14 remain vulnerable to the same java.lang.reflect.Proxy-based bypass CVE-2026-47065 was intended to close. Attackers can send crafted serialized objects that evade the class allow-list and trigger arbitrary code execution under the Java runtime hosting MINA.

Critical Impact
Unauthenticated network attackers can bypass the deserialization allow-list and achieve remote code execution on any application using Apache MINA 2.0.29–2.0.30 or 2.1.13–2.1.14.

Affected Products

Apache MINA 2.0.x branch, versions 2.0.29 and 2.0.30
Apache MINA 2.1.x branch, versions 2.1.13 and 2.1.14
Any downstream application that depends on the affected MINA ObjectSerializationDecoder with acceptMatchers configured

Discovery Timeline

2026-09-21 - CVE-2026-94301 published to the National Vulnerability Database
2026-09-22 - Record last modified in NVD

Technical Details for CVE-2026-94301

Vulnerability Analysis

Apache MINA's ObjectSerializationDecoder deserializes Java objects received over the network. The acceptMatchers mechanism restricts which classes may be resolved during deserialization. CVE-2026-47065 demonstrated that java.lang.reflect.Proxy instances bypass this filter because ObjectInputStream.resolveProxyClass() is invoked instead of resolveClass(). The fix added an override of resolveProxyClass() that consults the same allow-list.

That patch shipped only in the 2.2.8 release on the 2.2.x branch. The 2.0.29 and 2.1.13 artifacts labeled as fixed never received the override, and subsequent releases on those branches inherited the gap. Attackers who could exploit CVE-2026-47065 can exploit CVE-2026-94301 against every current 2.0.x and 2.1.x consumer.

Root Cause

The root cause is an incomplete patch backport, categorized under [CWE-502] Deserialization of Untrusted Data. The resolveProxyClass() override that enforces acceptMatchers on proxy interfaces was applied only to the 2.2.x source tree. The 2.0.x and 2.1.x branches continue to rely on the default ObjectInputStream behavior for proxy resolution, leaving the allow-list unenforced for proxy classes.

Attack Vector

An unauthenticated remote attacker sends a serialized Java payload containing a java.lang.reflect.Proxy wrapper that references gadget interfaces available on the target classpath. When MINA decodes the frame, resolveProxyClass() returns without consulting the allow-list, and the proxy's InvocationHandler executes attacker-controlled logic during deserialization. Full technical discussion is available in the Apache Mailing List Discussion and the Apache Mailing List Thread.

No verified proof-of-concept code is published for this specific CVE. The exploitation pattern mirrors CVE-2026-47065 and standard Java deserialization gadget chains that abuse dynamic proxies to invoke arbitrary methods on classpath objects.

Detection Methods for CVE-2026-94301

Indicators of Compromise

Inbound traffic to MINA listeners containing the Java serialization magic bytes AC ED 00 05 followed by proxy class descriptors.
Unexpected child processes or outbound connections spawned by Java processes hosting Apache MINA.
Deserialization exceptions in application logs referencing java.lang.reflect.Proxy or unfamiliar interface names.

Detection Strategies

Inventory Java dependencies for org.apache.mina:mina-core at versions 2.0.29, 2.0.30, 2.1.13, or 2.1.14 using software composition analysis.
Inspect network telemetry for serialized Java payloads reaching MINA-based services from untrusted sources.
Monitor Java runtime behavior for reflective method invocations and class loading initiated during socket read operations.

Monitoring Recommendations

Enable verbose logging on ObjectSerializationDecoder and forward events to a central analytics platform for correlation.
Alert on Java processes that load classes from unusual packages after receiving network input.
Track outbound network connections and process creation events originating from services that expose MINA endpoints.

How to Mitigate CVE-2026-94301

Immediate Actions Required

Identify every application bundling Apache MINA 2.0.29, 2.0.30, 2.1.13, or 2.1.14 and restrict network exposure of their MINA listeners.
Terminate untrusted client access to services that deserialize Java objects using MINA until a patched build is deployed.
Rotate credentials and secrets accessible to any MINA-hosting process that was internet-reachable before mitigation.

Patch Information

At publication, Apache MINA 2.2.8 is the only release containing the corrective resolveProxyClass() override. Migrate affected deployments to the 2.2.x branch, or track the Apache Mailing List Thread for a backported release on the 2.0.x and 2.1.x lines. Rebuild and redeploy downstream artifacts after upgrading the MINA dependency.

Workarounds

Subclass ObjectSerializationDecoder and override resolveProxyClass() to enforce the same acceptMatchers allow-list applied to resolveClass().
Replace Java serialization on the wire with a schema-based format such as Protocol Buffers or JSON with strict type binding.
Place MINA endpoints behind mutual TLS and network allow-lists so only trusted peers can send serialized payloads.

bash

# Configuration example: verify vulnerable MINA versions in a Maven project
mvn dependency:tree -Dincludes=org.apache.mina:mina-core

# Force upgrade to the patched 2.2.x branch
mvn versions:use-dep-version -Dincludes=org.apache.mina:mina-core -DdepVersion=2.2.8 -DforceVersion=true