WildFly EUVD-2026-102546

Requires an authenticated session on the WildFly management interface (HTTP/native management) holding at minimum the Monitor RBAC role, and RBAC access control must be enabled for the role boundary to be meaningful. The attacker must be able to reach the management endpoint and must have a writable, later-readable target path for the traversed snapshot file. Limiting factors: the Monitor account is a prerequisite (not remotely unauthenticated), the management interface is frequently bound to localhost or restricted networks rather than the public internet, and exploitation value depends on sensitive credentials actually being present in the server configuration.

This is a credible, moderate-priority privilege-boundary bypass rather than a critical internet-facing threat. The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L is the decisive moderator: the attacker must already hold a valid WildFly management account with the Monitor RBAC role, so this is a trusted-insider or post-authentication escalation issue, not a pre-auth mass-exploitation candidate. The real-world danger is the RBAC bypass semantics - the lowest-privilege role effectively reads credentials that RBAC is specifically designed to hide - which elevates its practical impact above a generic info-disclosure bug. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, which is consistent with a recently disclosed, Red-Hat-reported flaw that has not yet seen weaponization. The signals are internally consistent (no contradiction between CVSS, description, and absent exploitation data); the main uncertainty is operational - exploitability depends on how many deployments actually expose the management interface and grant Monitor accounts to semi-trusted users.

An attacker who has been granted (or has compromised) a low-privilege Monitor account on the WildFly management interface invokes the take-snapshot operation and sets the name parameter to a traversal path (e.g. ../../deployments/snapshot.xml), writing a full copy of the server configuration to a location they can read. They then retrieve that file to recover datasource passwords, keystores, and other credentials that RBAC would normally hide from the Monitor role. No public exploit identified at time of analysis; low attack complexity means a trivial parameter manipulation suffices once authenticated.