CVE-2026-67615: openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openEQUELLAto a version that resolves this vulnerability.Fixed in 2026.1.0
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Any authenticated non-guest openEQUELLA user can exploit the vulnerable HTTP invoker endpoint. No additional privileges or user interaction are required.
Which deployments are exposed?
openEQUELLA versions before 2026.1.0 are affected where the /invoker/* HTTP invoker endpoint is reachable by an authenticated user. The provided information does not state whether this endpoint is enabled in every default deployment.
What can an attacker do after successful exploitation?
An attacker can execute arbitrary code on the affected openEQUELLA system. The vulnerability has high impacts on confidentiality, integrity, and availability.
What is the remediation?
Upgrade openEQUELLA to version 2026.1.0 or later. The supplied data does not identify an alternative workaround for systems that cannot be upgraded immediately.