---
id: "CVE-2026-12977"
page: "https://infrastack.ai/live/CVE-2026-12977"
kind: "vulnerability"
aliases: ["CVE-2026-12977"]
title: "WildFly Core: Maintainer role can read sensitive files and take admin control"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "privilege-escalation", "rbac", "runtime", "self-hosted", "wildfly"]
not_affected_if: ["management-api-restricted", "no-maintainer-role-users"]
published_at: "2026-11-09T19:17:04+00:00"
first_seen_at: "2026-11-09T19:28:21+00:00"
updated_at: "2026-11-09T19:30:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12977", "first_seen_at": "2026-11-09T19:28:21+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-12977", "first_seen_at": "2026-11-09T19:30:30+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-12977"]}]
exploit_sources: []
---

# WildFly Core: Maintainer role can read sensitive files and take admin control

Link for people: https://infrastack.ai/live/CVE-2026-12977 (this .md is for agents)

WildFly Core's deployment operations, such as upload-deployment-url, do not classify some sensitive data properly. A user with the restricted Maintainer role can read sensitive configuration files, leak credentials, and gain full SuperUser control of the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether any account holds the Maintainer role on the WildFly/JBoss management interface (management-api RBAC config, e.g. standalone.xml/domain.xml role mappings). Affected versions not yet published; compare your WildFly Core version against Red Hat errata/Bugzilla 2491669 when a fix lands.

## Timeline

- 2026-11-09T19:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12977
- 2026-11-09T19:30:30+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-12977 — Red Hat CVE page read (Important, CVSS 8.8, CWE-267, Bugzilla 2491669, no mitigation offered). No affected/fixed versions published on it or NVD; check Bugzilla/errata. Exa search unavailable; X not checked. Not exploited, no PoC found.

## Documents

- [advisory] Red Hat CVE-2026-12977 https://access.redhat.com/security/cve/CVE-2026-12977

## From the sources

A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_