{"id":"CVE-2026-84823","kind":"vulnerability","aliases":["CVE-2026-84823"],"related":[],"title":"WildFly: Monitor role can write and read server config via path traversal","description":"A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.","summary":"A user with the lowest standard WildFly RBAC role, Monitor, can use a path traversal in the take-snapshot operation's name parameter to write a copy of the server configuration to an arbitrary location. That lets the Monitor user read back the configuration, including credentials that RBAC would otherwise hide.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.wildfly.core","fixed":[],"affected":"unknown","ecosystem":"maven"}],"ecosystems":[],"tags":["java","management-interface","rbac","runtime","self-hosted","wildfly"],"not_affected_if":["management-interface-not-reachable","no-monitor-role-users","rbac-disabled"],"how_to_check":"Run on the management CLI: /core-service=management/access=authorization:read-attribute(name=provider). If 'rbac', accounts with the Monitor role can reach the flaw; if 'simple', no Monitor role is enforced. Then list who holds Monitor: /core-service=management/access=authorization/role-mapping=Monitor:read-resource(recursive=true). Affected wildfly-core versions: unknown, not stated by Red Hat.","fix":"unknown: no fixed version published as of 2026-10-25 (Bugzilla 2527902 status NEW). Watch wildfly-core releases and the Red Hat CVE page. Interim, per Red Hat: restrict the management interface to trusted networks, and reduce Monitor role assignments.","status":"open","published_at":"2026-10-16T00:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:36:52+00:00","updated_at":"2026-10-25T03:49:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:36:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WildFly: Monitor role can write and read server config via path traversal","impact":"medium","summary":"A user with the lowest standard WildFly RBAC role, Monitor, can use a path traversal in the take-snapshot operation's name parameter to write a copy of the server configuration to an arbitrary location. That lets the Monitor user read back the configuration, including credentials that RBAC would otherwise hide.","category":"runtime","nicknames":[],"who_cares":["wildfly","self-hosted","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Monitor user reads server configuration including sensitive credentials","analyst_note":"Find the affected and fixed WildFly versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-84823 and check whether RBAC is on by default.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["rbac-disabled","no-monitor-role-users"],"who_is_affected":"Teams running WildFly with RBAC enabled and users or accounts assigned the Monitor role, since that role is what can trigger the flaw. Deployments where Monitor is not granted to untrusted users, or where only admin accounts exist, are less exposed. The sources do not state which WildFly versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000586,"input_tokens":3355,"output_tokens":502,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed WildFly versions and the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-84823 and check whether RBAC is on by default.","search":"'-2026':14A,17A '-84823':15A,18A 'access':102C 'allow':138C 'arbitrari':64B,135C 'back':72B,144C 'base':101C 'config':9A 'configur':61B,74B,132C,147C 'control':103C 'copi':57B,128C 'credenti':76B,150C 'cve':13A,16A 'disclosur':161C 'exploit':107C 'flaw':83C 'found':85C 'hide':81B 'host':28B 'includ':75B,148C 'inform':160C 'interfac':23B 'java':20B 'lead':158C 'let':67B 'locat':65B,136C 'lowest':34B,97C 'manag':22B 'management-interfac':21B 'manipul':119C 'monitor':2A,39B,69B,92C,140C 'name':52B,121C 'oper':50B,117C 'org.wildfly.core':19A 'otherwis':80B,153C 'paramet':53B,122C 'path':11A,43B,109C 'rbac':24B,37B,78B,104C,157C 'read':7A,71B,143C 'restrict':155C 'role':3A,38B,93C,100C,105C,141C 'role-bas':99C 'runtim':25B 'self':27B 'self-host':26B 'sensit':149C 'server':8A,60B,131C,146C 'snapshot':49B,116C 'standard':35B,98C 'take':48B,115C 'take-snapshot':47B,114C 'travers':12A,44B,110C 'use':41B 'user':31B,70B,89C,124C 'via':10A 'vulner':111C 'wildfli':1A,29B,36B,87C 'would':79B,152C 'write':5A,55B,126C","nicknames":[],"mitigations":[],"who_affected":"WildFly (org.wildfly.core) servers with RBAC enabled and at least one account mapped to the Monitor role who is not trusted with the server configuration. The flaw lets that account use take-snapshot to write the config, with credentials, to a location it can read. Servers whose management interface is reachable only by admins, or that run without RBAC, can skip it. Affected versions are not published yet.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T00:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84823","severity":null,"published_at":"2026-10-16T00:17:05+00:00","modified_at":"2026-10-20T09:17:11+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-84823:803","url":null,"severity":null,"published_at":"2026-10-25T03:49:59+00:00","modified_at":"2026-10-25T03:49:59+00:00","first_seen_at":"2026-10-25T03:49:59+00:00","fetched_at":"2026-10-25T03:49:59+00:00","note":"Red Hat CVE page + Bugzilla 2527902 read: component org.wildfly.core, Red Hat rates Low, bug status NEW, no affected/fixed versions published anywhere I found; no PoC, no exploitation seen. RBAC default not confirmed from a primary page (WildFly standalone default is the 'simple' provider, which I did not verify here)."}],"documents":[{"id":3364,"url":"https://access.redhat.com/security/cve/cve-2026-84823","title":"Red Hat CVE-2026-84823","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3365,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527902","title":"Bugzilla 2527902 (status NEW, no fixed-in version)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}