Bug 2491669 (CVE-2026-12977)

Summary: CVE-2026-12977 org.wildfly.core/wildfly-server: wildfly: RBAC bypass in WildFly deployment-operation handlers leads to privilege escalation
Product: [Other] Security Response Reporter: Abhishek Raj <abhraj>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, gmalinko, istudens, ivassile, iweiss, janstey, mosmerov, mposolda, msvehla, nwallace, pberan, pdelbell, pesilva, pjindal, pmackay, rmartinc, rstancel, rstepani, security-response-team, ssilvert, sthorger, thjenkin, tmielke, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Abhishek Raj 2026-06-23 10:41:26 UTC 
A Role-Based Access Control (RBAC) bypass vulnerability was discovered in WildFly Core's deployment-operation family. The root cause is the missing SensitivityClassification.READ_WHOLE_CONFIG on several operation handlers, including upload-deployment-url.
Under normal RBAC constraints, a user in the "Maintainer" role is denied access to sensitive configuration data. However, due to this flaw, a Maintainer can use these handlers to exfiltrate sensitive files from the server process, such as standalone.xml and mgmt-users.properties. These files contain HA1 password hashes for other administrative users. An attacker can then use these hashes to forge HTTP Digest authentication responses, effectively escalating their privileges to SuperUser and gaining full control over the server.