{"record":{"id":"87947b0885a8f437","repo":"apache/cassandra","slug":"access-is-denied","errorCode":null,"errorMessage":"Access is denied!","messagePattern":"Access is denied!","errorType":"exception","errorClass":"java.lang.SecurityException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java","lineNumber":548,"sourceCode":"        {\n            logger.warn(\"Could not interpret arguments to check vulnerable MBean invocations; did the MBeanServer interface change?\", cce);\n            return;\n        }\n\n        // When adding compiler directives from a file, most JDKs will log the file contents if invalid, which\n        // leads to an arbitrary file read vulnerability\n        checkCompilerDirectiveAddMethods(name, operationName);\n\n        // Loading arbitrary (JVM and native) libraries from remotes\n        checkJvmtiLoad(name, operationName);\n        checkMLetMethods(name, operationName);\n    }\n\n    private void checkCompilerDirectiveAddMethods(ObjectName name, String operation)\n    {\n        if (name.getCanonicalName().equals(\"com.sun.management:type=DiagnosticCommand\")\n                && operation.equals(\"compilerDirectivesAdd\"))\n            throw new SecurityException(\"Access is denied!\");\n    }\n\n    private void checkJvmtiLoad(ObjectName name, String operation)\n    {\n        if (name.getCanonicalName().equals(\"com.sun.management:type=DiagnosticCommand\")\n                && operation.equals(\"jvmtiAgentLoad\"))\n            throw new SecurityException(\"Access is denied!\");\n    }\n\n    private void checkMLetMethods(ObjectName name, String operation)\n    {\n        // Inspired by MBeanServerAccessController, but that class ignores check if a SecurityManager is installed,\n        // which we don't want\n\n        if (operation == null)\n            return;\n\n        try","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java#L530-L566","documentation":"AuthorizationProxy intentionally blocks JMX invocations of the DiagnosticCommand MBean operation 'compilerDirectivesAdd'. Allowing it would enable an arbitrary file read, because most JDKs log the contents of an invalid compiler directives file supplied as the argument. Cassandra's JMX authorization layer throws this SecurityException unconditionally, before any role-based permission check, so no JMX user is ever permitted this operation.","triggerScenarios":"Invoking the MBean 'com.sun.management:type=DiagnosticCommand' with operation 'compilerDirectivesAdd' through Cassandra's JMX MBeanServer (e.g. jcmd-style JMX call: mbeanServer.invoke(new ObjectName(\"com.sun.management:type=DiagnosticCommand\"), \"compilerDirectivesAdd\", ...)). checkVulnerableMethods inspects the ObjectName and operation name on every invoke and throws immediately.","commonSituations":"A monitoring or management client tries to JIT-tune a running Cassandra node by adding compiler directives over JMX; a security scan or penetration test probes for CVE-style JMX exposure; an operator follows JDK jcmd documentation without realizing Cassandra forbids this operation remotely.","solutions":["Do not call compilerDirectivesAdd over JMX on a Cassandra node; it is deliberately denied as a security hardening measure.","Apply JIT compiler directives at JVM startup instead, via -XX:CompilerDirectivesFile=<file> in jvm-server.options, then restart the node.","If diagnostic data was the goal, use a permitted DiagnosticCommand operation that Cassandra does allow, or use nodetool / local jcmd from the host itself.","If a legitimate use case exists, raise it with the Apache Cassandra community; do not patch out this check in production."],"exampleFix":"// before (JMX client tuning a running node)\nmbeanServer.invoke(new ObjectName(\"com.sun.management:type=DiagnosticCommand\"), \"compilerDirectivesAdd\", new Object[]{directiveFile}, new String[]{\"java.lang.String\"});\n\n// after (startup option instead of runtime JMX call)\n// in conf/jvm-server.options:\n// -XX:CompilerDirectivesFile=/etc/cassandra/compiler-directives.txt\n","handlingStrategy":"try-catch","validationCode":"if (name.getCanonicalName().equals(\"com.sun.management:type=DiagnosticCommand\") && op.equals(\"compilerDirectivesAdd\")) { throw new UnsupportedOperationException(\"compilerDirectivesAdd is blocked by Cassandra JMX authorization\"); }","typeGuard":null,"tryCatchPattern":"try { mbs.invoke(diagnosticCmdName, \"compilerDirectivesAdd\", params, sig); }\ncatch (SecurityException e) { logger.warn(\"compilerDirectivesAdd is denied by Cassandra JMX authorization; use -XX:CompilerDirectivesFile at startup instead\", e); }","preventionTips":["Treat JVM DiagnosticCommand compiler operations as unavailable over Cassandra JMX; audit any management tooling that calls them.","Apply JIT directives at startup via -XX:CompilerDirectivesFile in jvm-server.options.","Restrict remote JMX access (localhost bind, firewall, jaas auth) so probing tools never reach these MBeans."],"tags":["security","jmx","jvm","operation-blocked"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}