apache/cassandra · warning · SecurityException

Access denied

Error message

Access denied

What it means

AuthorizationProxy is the JDK dynamic Proxy placed in front of the platform MBeanServer for authenticated JMX access in Cassandra. Any attempt to call getMBeanServer through the proxy is unconditionally rejected with this SecurityException, because handing out the underlying MBeanServer reference would let clients bypass all JMX authorization. This is a deliberate hardening guard, not a configuration failure.

Source

Thrown at src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java:171

     */
    protected BooleanSupplier isAuthSetupComplete = () -> StorageService.instance.isAuthSetupComplete();

    protected JmxInvocationListener listener = AuditLogManager.instance;

    @Override
    public Object invoke(Object proxy, Method method, Object[] args)
            throws Throwable
    {
        String methodName = method.getName();

        // Retrieve Subject from current AccessControlContext
        AccessControlContext acc = AccessController.getContext();
        Subject subject = Subject.getSubject(acc);

        try
        {
            if ("getMBeanServer".equals(methodName))
                throw new SecurityException("Access denied");

            // Corresponds to MBeanServer.invoke
            if (methodName.equals("invoke") && args.length == 4)
                checkVulnerableMethods(args);

            // Allow setMBeanServer iff performed on behalf of the connector server itself
            if (("setMBeanServer").equals(methodName))
            {
                if (subject != null)
                    throw new SecurityException("Access denied");

                if (args[0] == null)
                    throw new IllegalArgumentException("Null MBeanServer");

                if (mbs != null)
                    throw new IllegalArgumentException("MBeanServer already initialized");

                mbs = (MBeanServer) args[0];

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Remove or change client code that calls getMBeanServer() on the JMX connection; operate via MBeanServerConnection methods (getAttribute/invoke/queryNames) instead.
2. If you need access to MBeans, query them by ObjectName through the proxy, ensuring the authenticated role has the required JMX permissions granted in cassandra.yaml authorizer roles.
3. If this occurs in a third-party tool, file/update a bug with the tool vendor since Cassandra will never permit this call.

Example fix

// before
MBeanServer server = connection.getMBeanServer();
// after
// use the proxied connection directly, e.g.
Set<ObjectName> names = connection.queryNames(new ObjectName("org.apache.cassandra.*:*"), null);

// client-side pre-check
if (methodName.equals("getMBeanServer"))
    throw new UnsupportedOperationException("getMBeanServer is never allowed through Cassandra's AuthorizationProxy");

try {
    return connection.getMBeanServer();
} catch (SecurityException e) {
    // fall back to proxied MBeanServerConnection operations
    logger.warn("getMBeanServer is blocked by JMX authorization; use the connection directly");
    return null;
}

When it happens

Trigger: A remote (or local authenticated) JMX client invokes MBeanServerConnection.getMBeanServer() — or any proxy method named "getMBeanServer" — on the proxied MBeanServerConnection. Line 171 fires immediately, before any role-based authorization is even consulted.

Common situations: JMX monitoring tools or custom client code that tries to obtain the raw MBeanServer via the connection; generic JMX libraries that call getMBeanServer as part of connection handshake/feature detection; developers testing the proxy and probing its wrapped object.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Access Denied
• Access is denied!
• Only superusers are allowed to alter access from CIDR groups
• The arbitrary command execution is not permitted with %s MBe
• Illegal file to fetch:

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/cc13d629d7985457. Report an issue: GitHub.