{"id":"CVE-2026-84823","title":"Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role","summary":"A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` para…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"Red Hat","product":"pki-core:10.6/resteasy","affected":["pki-core:10.6/resteasy","pki-deps:10.6/resteasy","resteasy","wildfly-cli (all versions)","wildfly-controller (all versions)","wildfly-controller-client (all versions)","wildfly-core-galleon-pack (all versions)","wildfly-core-management-client (all versions)","wildfly-core-management-subsystem (all versions)","wildfly-core-security","wildfly-core-security-api (all versions)","wildfly-deployment-repository (all versions)","wildfly-deployment-scanner (all versions)","wildfly-discovery (all versions)","wildfly-domain-http-error-context (all versions)","wildfly-domain-http-interface (all versions)","wildfly-domain-management (all versions)","wildfly-elytron-integration (all versions)","wildfly-elytron-tool-wrapper (all versions)","wildfly-embedded (all versions)","wildfly-event-logger (all versions)","wildfly-host-controller (all versions)","wildfly-io (all versions)","wildfly-jmx (all versions)","wildfly-launcher (all versions)","wildfly-logging (all versions)","wildfly-management-client-content (all versions)","wildfly-model-test (all versions)","wildfly-network (all versions)","wildfly-patching (all versions)","wildfly-platform-mbean (all versions)","wildfly-process-controller (all versions)","wildfly-protocol (all versions)","wildfly-remoting (all versions)","wildfly-request-controller (all versions)","wildfly-security-manager (all versions)","wildfly-self-contained (all versions)","wildfly-server (all versions)","wildfly-subsystem-test-framework (all versions)","wildfly-threads (all versions)","wildfly-version (all versions)","jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)","jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)","wildfly-cli (all versions)","wildfly-controller (all versions)","wildfly-controller-client (all versions)","wildfly-core-build (all versions)","wildfly-core-build-legacy (all versions)","wildfly-core-component-matrix-builder (all versions)"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T23:47:13.986Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84823","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-84823"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527902","label":"RHBZ#2527902"}],"tags":["cve.org"],"ingestedAt":"2026-10-15T23:54:16.910Z","slug":"CVE-2026-84823","body":"## Overview\n\nA flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.\n\n## Affected\n\n- `pki-core:10.6/resteasy`\n- `pki-deps:10.6/resteasy`\n- `resteasy`\n- `wildfly-cli (all versions)`\n- `wildfly-controller (all versions)`\n- `wildfly-controller-client (all versions)`\n- `wildfly-core-galleon-pack (all versions)`\n- `wildfly-core-management-client (all versions)`\n- `wildfly-core-management-subsystem (all versions)`\n- `wildfly-core-security`\n- `wildfly-core-security-api (all versions)`\n- `wildfly-deployment-repository (all versions)`\n- `wildfly-deployment-scanner (all versions)`\n- `wildfly-discovery (all versions)`\n- `wildfly-domain-http-error-context (all versions)`\n- `wildfly-domain-http-interface (all versions)`\n- `wildfly-domain-management (all versions)`\n- `wildfly-elytron-integration (all versions)`\n- `wildfly-elytron-tool-wrapper (all versions)`\n- `wildfly-embedded (all versions)`\n- `wildfly-event-logger (all versions)`\n- `wildfly-host-controller (all versions)`\n- `wildfly-io (all versions)`\n- `wildfly-jmx (all versions)`\n- `wildfly-launcher (all versions)`\n- `wildfly-logging (all versions)`\n- `wildfly-management-client-content (all versions)`\n- `wildfly-model-test (all versions)`\n- `wildfly-network (all versions)`\n- `wildfly-patching (all versions)`\n- `wildfly-platform-mbean (all versions)`\n- `wildfly-process-controller (all versions)`\n- `wildfly-protocol (all versions)`\n- `wildfly-remoting (all versions)`\n- `wildfly-request-controller (all versions)`\n- `wildfly-security-manager (all versions)`\n- `wildfly-self-contained (all versions)`\n- `wildfly-server (all versions)`\n- `wildfly-subsystem-test-framework (all versions)`\n- `wildfly-threads (all versions)`\n- `wildfly-version (all versions)`\n- `jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)`\n- `jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)`\n- `jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)`\n- `wildfly-cli (all versions)`\n- `wildfly-controller (all versions)`\n- `wildfly-controller-client (all versions)`\n- `wildfly-core-build (all versions)`\n- `wildfly-core-build-legacy (all versions)`\n- `wildfly-core-component-matrix-builder (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, restrict access to the WildFly management interface to trusted networks and users. Implement firewall rules to limit network reachability to the management ports. Additionally, review existing Role-Based Access Control (RBAC) assignments within WildFly and ensure that users are granted only the minimum necessary privileges, adhering to the principle of least privilege. Reviewing role assignments might impact functionality if users genuinely require the `Monitor` role for their operations.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}