OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked class, causing the real operation to execute inside JDK reflection without passing through the stricter-invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation     mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not     block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-     controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked     class, causing the real operation to execute inside JDK reflection without passing through the stricter-     invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use     the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter     invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with     SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13. (CVE-2026-113730)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation
    mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not
    block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.lang.reflect.Field. An attacker-
    controlled expression can invoke one of these reflection objects as a proxy for a method on a blocked
    class, causing the real operation to execute inside JDK reflection without passing through the stricter-
    invocation check again. Exploitation requires an application to evaluate untrusted OGNL expressions, use
    the default or an equivalently permissive MemberAccess that permits reflection, and rely on stricter
    invocation as a sandbox. Applications using a restrictive MemberAccess, including Apache Struts with
    SecurityMemberAccess, are not affected by this bypass. This issue is fixed in 3.4.13. (CVE-2026-113730)

ID	Name	Product	Family	Type	Severity
371027	Linux Distros Unpatched Vulnerability : CVE-2026-113730	Nessus	Misc.	Local	medium
476644	Chainguard: thingsboard-tb-node: security update to 4.4-r6	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
476644	Chainguard: thingsboard-tb-node: security update to 4.4-r6	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
476551	SCA: security update for ognl:ognl (GHSA-crwc-vw2r-qr6m)	Tenable Cloud Security	SCA Checks	Local	medium
476551	SCA: security update for ognl:ognl (GHSA-crwc-vw2r-qr6m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-113730

medium

Tenable Plugins

medium

medium

medium

medium

medium