highCVE-2026-47424Jun 29, 2026

CVE-2026-47424: OpenAM Authenticated Groovy Sandbox Escape to RCE

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in OpenAM's server-side Groovy scripting sandbox lets an authenticated script author run operating-system commands on the host, breaking the only code-level wall between a realm administrator a

Packageorg.openidentityplatform.openam:openam-scripting
Ecosystemmaven
Affected<= 16.0.6
Fixed in16.1.1

The problem

OpenAM's Groovy scripting engine enforces access control through a class allowlist and denylist checked by `GroovySandboxValueFilter`. The default denylist did not include OS-execution classes such as `java.lang.ProcessBuilder` and `java.lang.Runtime`, so a script author could call them directly to spawn arbitrary processes.

Any authenticated user who can create or edit a server-side script in an executed context (authentication, policy condition, OIDC claims) is affected. For a sub-realm admin, this crosses the documented privilege boundary and compromises the entire OpenAM process and every realm it serves.

Proof of concept

A working proof-of-concept for CVE-2026-47424 in org.openidentityplatform.openam:openam-scripting, with the exact payload below.

javascript
// Server-side Groovy script submitted via the OpenAM admin console or REST API
// Requires: authenticated session with script-create/edit permission

def cmd = ['/bin/bash', '-c', 'id > /tmp/pwned']
def proc = new ProcessBuilder(cmd)
    .redirectErrorStream(true)
    .start()
def out = proc.inputStream.text
logger.error('RCE output: ' + out)

The `GroovySandboxValueFilter` checks each accessed class against the configured allowlist and denylist at call time. Because `java.lang.ProcessBuilder` (and `java.lang.Runtime`) were absent from the default denylist, the filter passed them as allowed, and the script executed OS commands with JVM process privileges.

The root cause is CWE-693 (Protection Mechanism Failure): the sandbox existed but its default deny rules were incomplete. The 16.1.1 patch adds the missing execution-capable classes to the default denylist so any script attempting to reference them receives a `SecurityException` before the call is made.

Note: the sandbox also cannot block calls made through an allowed class to a disallowed one (transitive calls). The fix addresses direct access; defense in depth through least-privilege OS accounts is still recommended.

The fix

Upgrade to OpenAM Community Edition 16.1.1 or later. The patch adds `java.lang.ProcessBuilder`, `java.lang.Runtime`, and related OS-execution classes to the default Groovy sandbox denylist in `openam-scripting`. Until you can upgrade, restrict script-create and script-edit permissions to fully trusted administrators only, and audit existing scripts for calls to `ProcessBuilder`, `Runtime.exec`, or similar primitives.

Reporter not attributed.

References: [1][2]

Related research