apache/cassandra · error · java.lang.SecurityException

Access is denied!

Error message

Access is denied!

What it means

AuthorizationProxy intentionally blocks JMX invocations of the DiagnosticCommand MBean operation 'compilerDirectivesAdd'. Allowing it would enable an arbitrary file read, because most JDKs log the contents of an invalid compiler directives file supplied as the argument. Cassandra's JMX authorization layer throws this SecurityException unconditionally, before any role-based permission check, so no JMX user is ever permitted this operation.

Source

Thrown at src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java:548

        {
            logger.warn("Could not interpret arguments to check vulnerable MBean invocations; did the MBeanServer interface change?", cce);
            return;
        }

        // When adding compiler directives from a file, most JDKs will log the file contents if invalid, which
        // leads to an arbitrary file read vulnerability
        checkCompilerDirectiveAddMethods(name, operationName);

        // Loading arbitrary (JVM and native) libraries from remotes
        checkJvmtiLoad(name, operationName);
        checkMLetMethods(name, operationName);
    }

    private void checkCompilerDirectiveAddMethods(ObjectName name, String operation)
    {
        if (name.getCanonicalName().equals("com.sun.management:type=DiagnosticCommand")
                && operation.equals("compilerDirectivesAdd"))
            throw new SecurityException("Access is denied!");
    }

    private void checkJvmtiLoad(ObjectName name, String operation)
    {
        if (name.getCanonicalName().equals("com.sun.management:type=DiagnosticCommand")
                && operation.equals("jvmtiAgentLoad"))
            throw new SecurityException("Access is denied!");
    }

    private void checkMLetMethods(ObjectName name, String operation)
    {
        // Inspired by MBeanServerAccessController, but that class ignores check if a SecurityManager is installed,
        // which we don't want

        if (operation == null)
            return;

        try

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Do not call compilerDirectivesAdd over JMX on a Cassandra node; it is deliberately denied as a security hardening measure.
2. Apply JIT compiler directives at JVM startup instead, via -XX:CompilerDirectivesFile=<file> in jvm-server.options, then restart the node.
3. If diagnostic data was the goal, use a permitted DiagnosticCommand operation that Cassandra does allow, or use nodetool / local jcmd from the host itself.
4. If a legitimate use case exists, raise it with the Apache Cassandra community; do not patch out this check in production.

Example fix

// before (JMX client tuning a running node)
mbeanServer.invoke(new ObjectName("com.sun.management:type=DiagnosticCommand"), "compilerDirectivesAdd", new Object[]{directiveFile}, new String[]{"java.lang.String"});

// after (startup option instead of runtime JMX call)
// in conf/jvm-server.options:
// -XX:CompilerDirectivesFile=/etc/cassandra/compiler-directives.txt

if (name.getCanonicalName().equals("com.sun.management:type=DiagnosticCommand") && op.equals("compilerDirectivesAdd")) { throw new UnsupportedOperationException("compilerDirectivesAdd is blocked by Cassandra JMX authorization"); }

try { mbs.invoke(diagnosticCmdName, "compilerDirectivesAdd", params, sig); }
catch (SecurityException e) { logger.warn("compilerDirectivesAdd is denied by Cassandra JMX authorization; use -XX:CompilerDirectivesFile at startup instead", e); }

When it happens

Trigger: Invoking the MBean 'com.sun.management:type=DiagnosticCommand' with operation 'compilerDirectivesAdd' through Cassandra's JMX MBeanServer (e.g. jcmd-style JMX call: mbeanServer.invoke(new ObjectName("com.sun.management:type=DiagnosticCommand"), "compilerDirectivesAdd", ...)). checkVulnerableMethods inspects the ObjectName and operation name on every invoke and throws immediately.

Common situations: A monitoring or management client tries to JIT-tune a running Cassandra node by adding compiler directives over JMX; a security scan or penetration test probes for CVE-style JMX exposure; an operator follows JDK jcmd documentation without realizing Cassandra forbids this operation remotely.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Access denied
• Access Denied
• The arbitrary command execution is not permitted with %s MBe
• Illegal file to fetch:
• Can't enable audit log archiving via nodetool unless audit_l

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/87947b0885a8f437. Report an issue: GitHub.