{"record":{"id":"cc13d629d7985457","repo":"apache/cassandra","slug":"access-denied","errorCode":null,"errorMessage":"Access denied","messagePattern":"Access denied","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java","lineNumber":171,"sourceCode":"     */\n    protected BooleanSupplier isAuthSetupComplete = () -> StorageService.instance.isAuthSetupComplete();\n\n    protected JmxInvocationListener listener = AuditLogManager.instance;\n\n    @Override\n    public Object invoke(Object proxy, Method method, Object[] args)\n            throws Throwable\n    {\n        String methodName = method.getName();\n\n        // Retrieve Subject from current AccessControlContext\n        AccessControlContext acc = AccessController.getContext();\n        Subject subject = Subject.getSubject(acc);\n\n        try\n        {\n            if (\"getMBeanServer\".equals(methodName))\n                throw new SecurityException(\"Access denied\");\n\n            // Corresponds to MBeanServer.invoke\n            if (methodName.equals(\"invoke\") && args.length == 4)\n                checkVulnerableMethods(args);\n\n            // Allow setMBeanServer iff performed on behalf of the connector server itself\n            if ((\"setMBeanServer\").equals(methodName))\n            {\n                if (subject != null)\n                    throw new SecurityException(\"Access denied\");\n\n                if (args[0] == null)\n                    throw new IllegalArgumentException(\"Null MBeanServer\");\n\n                if (mbs != null)\n                    throw new IllegalArgumentException(\"MBeanServer already initialized\");\n\n                mbs = (MBeanServer) args[0];","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/jmx/AuthorizationProxy.java#L153-L189","documentation":"AuthorizationProxy is the JDK dynamic Proxy placed in front of the platform MBeanServer for authenticated JMX access in Cassandra. Any attempt to call getMBeanServer through the proxy is unconditionally rejected with this SecurityException, because handing out the underlying MBeanServer reference would let clients bypass all JMX authorization. This is a deliberate hardening guard, not a configuration failure.","triggerScenarios":"A remote (or local authenticated) JMX client invokes MBeanServerConnection.getMBeanServer() — or any proxy method named \"getMBeanServer\" — on the proxied MBeanServerConnection. Line 171 fires immediately, before any role-based authorization is even consulted.","commonSituations":"JMX monitoring tools or custom client code that tries to obtain the raw MBeanServer via the connection; generic JMX libraries that call getMBeanServer as part of connection handshake/feature detection; developers testing the proxy and probing its wrapped object.","solutions":["Remove or change client code that calls getMBeanServer() on the JMX connection; operate via MBeanServerConnection methods (getAttribute/invoke/queryNames) instead.","If you need access to MBeans, query them by ObjectName through the proxy, ensuring the authenticated role has the required JMX permissions granted in cassandra.yaml authorizer roles.","If this occurs in a third-party tool, file/update a bug with the tool vendor since Cassandra will never permit this call."],"exampleFix":"// before\nMBeanServer server = connection.getMBeanServer();\n// after\n// use the proxied connection directly, e.g.\nSet<ObjectName> names = connection.queryNames(new ObjectName(\"org.apache.cassandra.*:*\"), null);","handlingStrategy":"try-catch","validationCode":"// client-side pre-check\nif (methodName.equals(\"getMBeanServer\"))\n    throw new UnsupportedOperationException(\"getMBeanServer is never allowed through Cassandra's AuthorizationProxy\");","typeGuard":null,"tryCatchPattern":"try {\n    return connection.getMBeanServer();\n} catch (SecurityException e) {\n    // fall back to proxied MBeanServerConnection operations\n    logger.warn(\"getMBeanServer is blocked by JMX authorization; use the connection directly\");\n    return null;\n}","preventionTips":["Never rely on obtaining the underlying MBeanServer from a JMX connection; code against MBeanServerConnection.","When integrating third-party JMX clients, verify they do not call getMBeanServer during handshake."],"tags":["security","jmx","authorization"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}