Package
guacamole-client-extensions
Component
ognl
Latest update
5.6
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
CVE-2026-113730 is fixed in OGNL 3.4.13 (https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m). The affected copy is OGNL 3.4.4, which MyBatis 3.5.19 bundles inside its own classes under a relocated package; the Guacamole JDBC authentication extensions for MySQL, PostgreSQL and SQL Server package those MyBatis classes into their jars, so the copy cannot be updated independently of MyBatis. Guacamole 1.6.0 and its development branch both use MyBatis 3.5.19. MyBatis 3.5.19 is the newest MyBatis release; MyBatis has moved to OGNL 3.4.16 on its development branch, but no release with it has been published. Waiting for the first upstream release containing the fix.
Status