---
id: "CVE-2010-0738"
kind: "vulnerability"
aliases: ["CVE-2010-0738"]
title: "Red Hat JBoss: Red Hat JBoss Authentication Bypass Vulnerability"
severity: "high"
cvss: 5.3
epss: 0.74722
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Red Hat JBoss", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "jboss", "ransomware", "red-hat-jboss-eap", "runtime", "self-hosted"]
not_affected_if: ["jmx-console-removed", "not-jboss"]
published_at: "2010-04-28T22:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0738", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-0738", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0738", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Red Hat JBoss: Red Hat JBoss Authentication Bypass Vulnerability

The JMX-Console web application in Red Hat JBoss Enterprise Application Platform only enforces access control on GET and POST requests. A remote attacker can reach its GET handler by sending the same request with a different HTTP method and skip the login check.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Red Hat JBoss affected ? fixed ?

## Fix

Apply the Red Hat JBoss updates per vendor instructions (CISA required action); the specific fixed version is unknown from these sources.
Restrict or remove the jmx-console web application if it is not needed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0738
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-0738
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-0738

## From the sources

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_