CVE-2024-54676 is a critical severity (CVSS 9.8) deserialization flaw in Apache OpenMeetings from 2.1.0 before 8.0.0. The default clustering instructions did not set OpenJPA allow and block lists. Upgrade to 8.0.0 and update startup scripts with the documented OpenJPA serialization settings.
What's affected
The Apache announcement says Apache OpenMeetings from 2.1.0 before 8.0.0 is affected. The fix is version 8.0.0.
The cause was in the documentation: the default clustering instructions at the OpenMeetings clustering page did not specify allow and block lists for OpenJPA. That leaves deserialization of untrusted data open on clustered setups that followed the guide.
Apache also asks users to update their startup scripts with the openjpa.serialization.class.blacklist and openjpa.serialization.class.whitelist configurations shown in the updated documentation. Upgrading alone may not be enough if your scripts still lack those settings.
How to check if you're exposed
Find the version of each OpenMeetings server from the admin panel or the install directory, and check how it is started.
ps aux | grep -i openmeetings | grep -o "openjpa[^ ]*"
If the output shows no openjpa serialization class settings, your start script lacks them. Also check whether clustering is on, since the documented risk comes from the clustering setup instructions.
What to do now
- Find all OpenMeetings servers and read their versions.
- Upgrade to 8.0.0 or later.
- Update the startup scripts with the OpenJPA serialization class allow and block settings from the project documentation.
- Close cluster communication ports to anything but cluster members.
- Restart the servers and confirm the settings are applied.
Why it matters
The weakness is CWE-502 (Deserialization of Untrusted Data). Deserialization of data from an untrusted source can lead to the execution of code, if the attacker can choose the classes that get built. Allow and block lists limit which classes are accepted, which is what the default instructions left out.
This case shows how documentation can be the source of a flaw: operators followed the published steps and ended up exposed. The score of 9.8 reflects network reach with no login required. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-54676.
Quick check
Is upgrading enough for CVE-2024-54676?
Apache recommends upgrading to 8.0.0 and also updating startup scripts with the OpenJPA serialization settings.
Which versions are affected?
From 2.1.0 before 8.0.0.
Sources
- Apache announcement (listed in the NVD record)
- oss-security post (listed in the NVD record)
- Gold entry for CVE-2024-54676
Last reviewed: 19 October 2026.
