---
id: "CVE-2026-84823"
kind: "vulnerability"
aliases: ["CVE-2026-84823"]
title: "WildFly: Monitor role can write and read server config via path traversal"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "org.wildfly.core", "fixed": [], "affected": "unknown", "ecosystem": "maven"}]
ecosystems: []
tags: ["java", "management-interface", "rbac", "runtime", "self-hosted", "wildfly"]
not_affected_if: ["management-interface-not-reachable", "no-monitor-role-users", "rbac-disabled"]
published_at: "2026-10-16T00:17:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:49:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84823", "first_seen_at": "2026-10-23T21:57:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:49:59+00:00"}]
---

# WildFly: Monitor role can write and read server config via path traversal

A user with the lowest standard WildFly RBAC role, Monitor, can use a path traversal in the take-snapshot operation's name parameter to write a copy of the server configuration to an arbitrary location. That lets the Monitor user read back the configuration, including credentials that RBAC would otherwise hide.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.wildfly.core affected unknown fixed ?

## How to check

Run on the management CLI: /core-service=management/access=authorization:read-attribute(name=provider). If 'rbac', accounts with the Monitor role can reach the flaw; if 'simple', no Monitor role is enforced. Then list who holds Monitor: /core-service=management/access=authorization/role-mapping=Monitor:read-resource(recursive=true). Affected wildfly-core versions: unknown, not stated by Red Hat.

## Fix

unknown: no fixed version published as of 2026-10-25 (Bugzilla 2527902 status NEW). Watch wildfly-core releases and the Red Hat CVE page. Interim, per Red Hat: restrict the management interface to trusted networks, and reduce Monitor role assignments.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84823
- 2026-10-25T03:49:59+00:00 analyst — Red Hat CVE page + Bugzilla 2527902 read: component org.wildfly.core, Red Hat rates Low, bug status NEW, no affected/fixed versions published anywhere I found; no PoC, no exploitation seen. RBAC default not confirmed from a primary page (WildFly standalone default is the 'simple' provider, which I did not verify here).

## Documents

- [advisory] Red Hat CVE-2026-84823 https://access.redhat.com/security/cve/cve-2026-84823
- [describes] Bugzilla 2527902 (status NEW, no fixed-in version) https://bugzilla.redhat.com/show_bug.cgi?id=2527902

## From the sources

A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_