{"id":"CVE-2026-12977","kind":"vulnerability","aliases":["CVE-2026-12977"],"related":[],"title":"WildFly Core: Maintainer role can read sensitive files and take admin control","description":"A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted \"Maintainer\" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.","summary":"WildFly Core's deployment operations, such as upload-deployment-url, do not classify some sensitive data properly. A user with the restricted Maintainer role can read sensitive configuration files, leak credentials, and gain full SuperUser control of the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","privilege-escalation","rbac","runtime","self-hosted","wildfly"],"not_affected_if":["management-api-restricted","no-maintainer-role-users"],"how_to_check":"Check whether any account holds the Maintainer role on the WildFly/JBoss management interface (management-api RBAC config, e.g. standalone.xml/domain.xml role mappings). Affected versions not yet published; compare your WildFly Core version against Red Hat errata/Bugzilla 2491669 when a fix lands.","fix":null,"status":"open","published_at":"2026-11-09T19:17:04+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","triaged_at":"2026-11-09T19:29:24+00:00","updated_at":"2026-11-09T19:30:30+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-09T19:29:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WildFly Core: Maintainer role can read sensitive files and take admin control","impact":"high","summary":"WildFly Core's deployment operations, such as upload-deployment-url, do not classify some sensitive data properly. A user with the restricted Maintainer role can read sensitive configuration files, leak credentials, and gain full SuperUser control of the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wildfly","java","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Credentials leak and attacker gains full SuperUser control of server","analyst_note":"Find affected and fixed WildFly Core versions and the advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12977.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-maintainer-role-users","management-api-restricted"],"who_is_affected":"Servers running WildFly Core where administrators have granted users the Maintainer role on the management interface. Installations where only fully trusted administrators can reach the management API are less exposed. The sources do not list affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4553,"output_tokens":473,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed WildFly Core versions and the advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12977.","search":"'-12977':15A,18A '-2026':14A,17A 'admin':11A 'administr':96C,117C 'allow':94C 'certain':82C 'classif':93C 'classifi':42B 'configur':57B,105C 'control':12A,65B,118C 'core':2A,30B,81C 'credenti':60B,114C 'cve':13A,16A 'data':45B 'deploy':32B,38B,76C,88C 'deployment-oper':75C 'escal':22B 'exfiltr':112C 'famili':78C 'file':8A,58B,106C 'flaw':70C 'found':72C 'full':63B,116C 'gain':62B 'handler':83C 'host':27B 'java':19B 'lack':90C 'lead':109C 'leak':59B 'maintain':3A,52B,100C 'oper':33B,77C 'privileg':21B 'privilege-escal':20B 'proper':46B,91C 'rbac':23B 'read':6A,55B,103C 'restrict':51B,99C 'role':4A,53B,101C 'runtim':24B 'self':26B 'self-host':25B 'sensit':7A,44B,56B,92C,104C 'server':68B,122C 'superus':64B,119C 'take':10A 'upload':37B,87C 'upload-deployment-url':36B,86C 'url':39B,89C 'user':48B 'wildfli':1A,28B,29B,80C","nicknames":[],"mitigations":[],"who_affected":"Servers running WildFly Core (and Red Hat products built on it) where users hold the Maintainer role on the management interface. The flaw lets such a user bypass RBAC via deployment-operation handlers and escalate to SuperUser. Teams where only fully trusted admins reach the management API, or no one has the Maintainer role, can skip it. Affected and fixed versions are not yet stated by Red Hat.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","java","privilegeescalation","rbac","runtime","selfhosted","wildfly"],"campaign_type":null,"search_a":"'-12977':15A,18A '-2026':14A,17A 'admin':11A 'control':12A 'core':2A 'cve':13A,16A 'file':8A 'maintain':3A 'read':6A 'role':4A 'sensit':7A 'take':10A 'wildfli':1A","search_b":"'classifi':42B 'configur':57B 'control':65B 'core':30B 'credenti':60B 'data':45B 'deploy':32B,38B 'escal':22B 'file':58B 'full':63B 'gain':62B 'host':27B 'java':19B 'leak':59B 'maintain':52B 'oper':33B 'privileg':21B 'privilege-escal':20B 'proper':46B 'rbac':23B 'read':55B 'restrict':51B 'role':53B 'runtim':24B 'self':26B 'self-host':25B 'sensit':44B,56B 'server':68B 'superus':64B 'upload':37B 'upload-deployment-url':36B 'url':39B 'user':48B 'wildfli':28B,29B","search_c":"'administr':96C,117C 'allow':94C 'certain':82C 'classif':93C 'configur':105C 'control':118C 'core':81C 'credenti':114C 'deploy':76C,88C 'deployment-oper':75C 'exfiltr':112C 'famili':78C 'file':106C 'flaw':70C 'found':72C 'full':116C 'handler':83C 'lack':90C 'lead':109C 'maintain':100C 'oper':77C 'proper':91C 'read':103C 'restrict':99C 'role':101C 'sensit':92C,104C 'server':122C 'superus':119C 'upload':87C 'upload-deployment-url':86C 'url':89C 'wildfli':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12977","severity":null,"published_at":"2026-11-09T19:17:04+00:00","modified_at":"2026-11-09T19:17:04+00:00","first_seen_at":"2026-11-09T19:28:21+00:00","fetched_at":"2026-11-09T19:28:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-12977:2316","url":"https://access.redhat.com/security/cve/CVE-2026-12977","severity":null,"published_at":"2026-11-09T19:30:30+00:00","modified_at":"2026-11-09T19:30:30+00:00","first_seen_at":"2026-11-09T19:30:30+00:00","fetched_at":"2026-11-09T19:30:30+00:00","note":"Red Hat CVE page read (Important, CVSS 8.8, CWE-267, Bugzilla 2491669, no mitigation offered). No affected/fixed versions published on it or NVD; check Bugzilla/errata. Exa search unavailable; X not checked. Not exploited, no PoC found.","cites":["https://access.redhat.com/security/cve/CVE-2026-12977"]}],"documents":[{"id":109478,"url":"https://access.redhat.com/security/cve/CVE-2026-12977","title":"Red Hat CVE-2026-12977","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}