CVE-2026-50633: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Synopsis

A JNDI injection vulnerability exists in Apache CXF's JCA integration module, specifically in the DispatchMDBMessageListenerImpl component. The flaw is reachable over the network without authentication, though exploitation requires the attacker to manipulate a JCA deployment descriptor (ra.xml) or runtime activation parameters, adding a layer of complexity. Successful exploitation enables full remote code execution on the host running the affected CXF instance. A patched-image rebuild at versions 4.1.7 or 4.2.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, meaning an attacker must be able to reach the CXF service remotely to attempt exploitation.

• AuthenticationNot required

  No credentials or account are needed; the attacker can interact with the service as an unauthenticated party.

• Victim interactionNot required

  Exploitation does not depend on any action by a user or administrator on the target system.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must be able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters, which requires specific preconditions beyond a simple unauthenticated request.

Blast Radius

• A successful attacker achieves remote code execution on the host running the affected Apache CXF instance.
• Confidential data accessible to the CXF process, including secrets, credentials, and application data, is readable by the attacker.
• The attacker can write or modify files and application state on the host, including persisted data and configuration.
• The attacker can crash or destabilize the CXF service and any dependent workloads, causing a service outage.