Live › vulnerability › CVE-2026-19610
The platform-mbean component of JBoss EAP skips role-based access checks on a read operation for runtime management data. An authenticated user with only the Monitor role can view sensitive system properties and JVM configuration details they should not see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Teams running JBoss EAP that have accounts with the Monitor role or other low-privileged management access. The sources describe the flaw as needing an authenticated user, so unauthenticated exposure is not stated. Installations with no low-privileged management users are less exposed; the sources do not say more.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.
This page as .md · .json · in your agent: get_signal("CVE-2026-19610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.