CVE-2026-12977 · Runtime
NO FIX YET
WildFly Core's deployment operations, such as upload-deployment-url, do not classify some sensitive data properly. A user with the restricted Maintainer role can read sensitive configuration files, leak credentials, and gain full SuperUser control of the server.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running WildFly Core (and Red Hat products built on it) where users hold the Maintainer role on the management interface. The flaw lets such a user bypass RBAC via deployment-operation handlers and escalate to SuperUser. Teams where only fully trusted admins reach the management API, or no one has the Maintainer role, can skip it. Affected and fixed versions are not yet stated by Red Hat.
Not affected if management-api-restricted, no-maintainer-role-users
Who cares java, privilege-escalation, rbac, self-hosted, wildfly
Unknown from the sources.
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.