Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation
Affects Red Hat JBoss EAP 7 and 8, Fuse 7, the EAP Expansion Pack and Single Sign-On 7 where a Maintainer-role administrator can reach deployment-operation handlers such as upload-deployment-url. No fixed version is listed in these facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Attacker must hold the Maintainer role (an administrator with restricted privileges) Affected handlers in the WildFly Core deployment-operation family, such as upload-deployment-url, lack sensitivity classification
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A flaw in the deployment-operation handlers of WildFly Core, the Java application server, lets an attacker who holds the restricted Maintainer role read sensitive configuration files, which can expose credentials and lead to full SuperUser control of the server. The attack can be carried out remotely over the network, but it requires the attacker to log in with low-privilege credentials.
Read the original description
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Shipped in major Linux distributions
- Severity8.8/10CVSS 8.8
- No patch5/5No patch listed yet
What would change the score
- Would score about 82 if added to CISA KEV
- Would score about 77 if CISA's SSVC rates exploitation active
- Would score about 39 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Attacker must hold the Maintainer role (an administrator with restricted privileges) Affected handlers in the WildFly Core deployment-operation family, such as upload-deployment-url, lack sensitivity classificationWorkaround: The facts state no workaround. Because the issue requires the Maintainer role, the facts only point to reviewing which accounts hold that role, and no vendor-stated mitigation is given.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- wildfly-server
Version range not reported
- wildfly-server
Version range not reported
- wildfly-server
Version range not reported
- wildfly-server
Version range not reported
- wildfly-server
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-12977
Is CVE-2026-12977 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Certain WildFly Core deployment-operation handlers, such as upload-deployment-url, lack proper sensitivity classification. This lets an administrator with the restricted Maintainer role read sensitive configuration files such as credentials and gain full SuperUser control of the server, bypassing RBAC.Source: access.redhat.com
Am I affected, and how do I check?
The affected products are Red Hat Fuse 7, JBoss Enterprise Application Platform 7 and 8, the EAP Expansion Pack, and Single Sign-On 7. The facts give no version ranges, so compare your installed product version against the vendor advisory. The issue involves the Maintainer role and the deployment-operation handlers.Source: access.redhat.com
How do I fix CVE-2026-12977?
The facts do not name a fixed release, so the upgrade target cannot be determined from them. Check the Red Hat advisory for the product release that contains the fix.Source: access.redhat.com
What if there's no patch?
The facts state no workaround. Because the issue requires the Maintainer role, the facts only point to reviewing which accounts hold that role, and no vendor-stated mitigation is given.Source: access.redhat.com