Metrics
Affected Vendors & Products
No advisories yet.
Solution
No solution given by the vendor.
Workaround
To mitigate this issue, restrict access to the WildFly management interface to trusted networks and users. Implement firewall rules to limit network reachability to the management ports. Additionally, review existing Role-Based Access Control (RBAC) assignments within WildFly and ensure that users are granted only the minimum necessary privileges, adhering to the principle of least privilege. Reviewing role assignments might impact functionality if users genuinely require the `Monitor` role for their operations.
Fri, 16 Oct 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure. | |
| Title | Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| Weaknesses | CWE-22 | |
| CPEs | cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:jbosseapxp cpe:/a:redhat:red_hat_single_sign_on:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat jbosseapxp Redhat red Hat Single Sign On |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-10-15T23:47:13.986Z
Reserved: 2026-09-02T10:32:15.835Z
Link: CVE-2026-84823
No data.
Status : Received
Published: 2026-10-16T00:17:05.573
Modified: 2026-10-16T00:17:05.573
Link: CVE-2026-84823
No data.
OpenCVE Enrichment
No data.