A flaw was found in the deployment-operation family of WildFly Core.
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Red Hat
- Product
- Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8
- CVSS v3.1
- 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-267
- Exposure class
- Web platform, Identity
- NVD status
- Awaiting Analysis
Why it ranks 37 (Notable)
- CVSS v3.1 8.8 high
- Exposed product class: identity
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-12977 on this site · NVD · CVE.org · Vulnpedia