{"id":"CVE-2026-12977","published":"2026-11-09T19:17:04.307","lastModified":"2026-11-09T19:17:04.433","description":"A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted \"Maintainer\" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-267"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12977","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491669","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A sensitivity classification flaw in WildFly Core's deployment-operation handlers (e.g., upload-deployment-url) allows users with the 'Maintainer' role to read sensitive configuration files, leading to credential exposure and full administrative compromise.","exploitability":"Exploitation requires authenticated access with the 'Maintainer' role and knowledge of the vulnerable handler endpoints; no public exploit exists.","blast_radius":"Successful exploitation enables full server compromise, including credential theft and elevation to SuperUser privileges, affecting all services managed by the WildFly instance.","remediation":"Upgrade to WildFly Core 3.0.14.Final, 4.0.2.Final, or later, as these versions include the fix for improper sensitivity classification in deployment-operation handlers.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","sensitive-data-exposure","wildfly","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:48:04.330Z"}}