Internal API Boundaries Fail Open to Code Execution
Bonita and OFBiz show the same break: path checks, CSRF checks, and basic auth do not protect an internal route if the server can be tricked into reading the URL differently. In both chains, a single unauthenticated request is normalized into the internal surface and reaches a code-execution sink, so the usual public-versus-internal split does not hold.
Novee disclosed the chains at Black Hat USA 2026. One targets Bonita BPM 10.4.3 and rides the gap between Tomcat path handling and Bonita’s separate filters; the other targets Apache OFBiz 24.09.05 and uses the product’s own SSO key trust to reach execution. The impact is not limited to the named CVE, CVE-2026-31986; it is the design pattern of treating internal Java routes as if they were unreachable from the web.