EUVD-2026-52568
GHSA-62xj-w627-m337
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Network vector via slave-DC protocol; AC:H and PR:H because attacker must already possess or have compromised slave HC credentials; confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (e.g., ../../etc/passwd) via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials.
AnalysisAI
Path traversal in WildFly's domain mode LocalFileRepository exposes arbitrary files readable by the Domain Controller process to attackers who have already obtained or compromised a slave host controller. The flaw resides in the wildfly-core/deployment-repository component, where getFile() and getConfigurationFile() fail to canonicalize or bound-check caller-supplied paths before resolving them on disk, enabling directory traversal sequences to escape the configured repository root. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified, but successful exploitation yields high-confidence access to sensitive artifacts including keystores, credentials, and configuration files.
Technical ContextAI
CWE-22 (Path Traversal) manifests in the wildfly-core deployment-repository module, specifically within the LocalFileRepository class. WildFly's domain mode uses a Domain Controller (DC) and one or more slave Host Controllers (slave HCs) that communicate over a proprietary binary wire protocol (slave-DC protocol). The DC exposes file-serving operations - getFile() and getConfigurationFile() - intended to distribute deployment artifacts and configuration to managed slave nodes. These methods accept relative path parameters from the slave HC but perform no validation to ensure the resolved absolute path remains within the declared repository root or configuration root directory. An attacker controlling a slave HC endpoint can inject '../../' sequences into these parameters, causing the DC's JVM process to open and transmit files from arbitrary locations on the DC host filesystem. Affected CPE strings confirm impact across Red Hat JBoss Enterprise Application Platform 7 (cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_7), JBoss EAP 8, the EAP Expansion Pack, and Red Hat Single Sign-On 7, all of which embed the affected WildFly core.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-17614 for the definitive patched release version, as exact fixed version numbers were not available in the input data at time of analysis - patch status should be treated as 'Patch available per vendor advisory' pending Red Hat's formal release notes. Until a patched version is applied, the most effective compensating control is to restrict the slave-DC wire protocol to a dedicated, isolated management network segment using firewall rules or network ACLs, ensuring only trusted, known-good slave HC IP addresses can reach the Domain Controller's management port (default 9999/tcp for native management). Rotate the slave host controller shared secret immediately if there is any concern about credential exposure, and audit all systems currently configured as slave HCs for signs of compromise. Reducing the number of managed slave HCs in sensitive domain deployments limits blast radius. If domain mode is not operationally required, migrating affected nodes to standalone mode eliminates the slave-DC attack surface entirely, though this carries significant operational overhead for large managed deployments.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Unrestricted Java deserialization in Red Hat EAP's embedded Apache ActiveMQ Artemis broker allows authenticated JMS clie
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the J
A remote, unauthenticated attacker can exhaust the JVM heap and cause a denial of service by sending a small crafted ima
Unbounded per-connection queue growth in Netty's WebSocketServerExtensionHandler lets unauthenticated remote attackers e
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned a
Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today