Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.

Etkilenen sürümler4 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-19610 Diğer

Kayıt geçmişi

1. 29 Eki 2026 09:07Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restart
• 4,2 CVE-2026-118030Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
• 5,3 CVE-2026-117688Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration
• 5,4 CVE-2026-117627Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
• 7,4 CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
• 7,4 CVE-2026-15564Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization