CVE-2026-17614: WildFly Path Traversal Vulnerability

CVE-2026-17614 Overview

CVE-2026-17614 is a path traversal vulnerability [CWE-22] in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository fail to validate that resolved file paths remain within the configured repository or configuration root directories. An attacker who has obtained the slave host controller secret, or who has compromised a slave host controller, can supply crafted relative paths containing directory traversal sequences over the slave-DC wire protocol. The Domain Controller then resolves and serves arbitrary files readable by the DC process.

Critical Impact
Successful exploitation discloses sensitive files such as domain configuration, keystores, and system credentials from the Domain Controller host.

Affected Products

WildFly Core deployment-repository component
Red Hat JBoss Enterprise Application Platform (domain mode deployments)
WildFly application server instances operating as Domain Controllers

Discovery Timeline

2026-08-04 - CVE-2026-17614 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-17614

Vulnerability Analysis

WildFly domain mode centralizes management across multiple host controllers using a Domain Controller (DC) that distributes deployments and configuration. Slave host controllers request files from the DC through a wire protocol backed by LocalFileRepository. The affected methods accept a relative path from the slave and resolve it against a repository or configuration root without canonicalizing the result or verifying containment. A slave can therefore request paths such as ../../etc/passwd and receive the raw file contents from the DC filesystem.

The returned data is limited only by the file permissions of the DC process. In typical deployments that process reads keystores, management users files, vault contents, and application configuration, so disclosure extends well beyond public deployment content. The flaw does not permit writing or code execution directly, but leaked keystores and credential files often enable further compromise of the domain.

Root Cause

The root cause is missing path containment validation in LocalFileRepository.getFile() and getConfigurationFile(). Both methods trust the caller-supplied relative path and resolve it directly against a base directory. Neither method canonicalizes the resolved path or compares it to the intended root before opening the file, allowing directory traversal sequences to escape the repository boundary.

Attack Vector

Exploitation requires network access to the Domain Controller and possession of the slave host controller authentication secret, or prior compromise of a slave host. Once authenticated as a slave, the attacker issues file-retrieval requests over the slave-DC protocol containing crafted relative paths. The DC resolves the traversal, reads the target file, and returns its contents to the attacker-controlled slave. See the Red Hat CVE-2026-17614 Report and Red Hat Bug 2507631 Details for protocol-level analysis.

No verified proof-of-concept code is publicly available.
Refer to the Red Hat advisory for technical details on the
slave-DC file-retrieval request format.

Detection Methods for CVE-2026-17614

Indicators of Compromise

Domain Controller access logs containing file-retrieval requests with .., ..%2f, or encoded traversal sequences in the path parameter.
Unexpected reads of sensitive files such as standalone.xml, mgmt-users.properties, vault.keystore, or OS files like /etc/passwd by the WildFly process.
Slave host controller connections originating from unexpected source addresses or at abnormal times.

Detection Strategies

Enable audit logging on the Domain Controller and alert on any resolved file path that lies outside the configured deployment or configuration root.
Correlate slave host controller authentication events with subsequent file-retrieval volume and target paths to identify anomalous access patterns.
Monitor the WildFly process using host-based file access telemetry and flag reads of credential stores or OS-level configuration files.

Monitoring Recommendations

Forward WildFly management and audit logs to a centralized SIEM for retention and correlation across host controllers.
Track failed and successful slave-DC handshakes to detect brute-force or reuse of the slave secret.
Baseline normal deployment-repository read patterns and alert on deviation, especially bursts of traversal-shaped paths.

How to Mitigate CVE-2026-17614

Immediate Actions Required

Rotate the slave host controller authentication secret across all managed hosts to invalidate any credential an attacker may already hold.
Restrict network access to the Domain Controller management ports so that only trusted slave hosts can connect.
Audit recent Domain Controller logs for traversal-shaped path requests and investigate any files that may have been disclosed.

Patch Information

Refer to the Red Hat CVE-2026-17614 Report for the list of fixed WildFly Core and JBoss EAP versions and apply the vendor-supplied updates. Additional remediation context is available in Red Hat Bug 2507631 Details.

Workarounds

Isolate the Domain Controller on a dedicated management network segment reachable only by authorized host controllers.
Run the WildFly process under a dedicated low-privilege account whose filesystem read scope excludes OS credential files and unrelated application data.
Store keystores, vault files, and secrets outside any directory readable by the WildFly service account until patched.

bash

# Configuration example: restrict WildFly service account filesystem scope
chown -R wildfly:wildfly /opt/wildfly
chmod 750 /opt/wildfly
chmod 600 /opt/wildfly/domain/configuration/mgmt-users.properties
chmod 600 /opt/wildfly/domain/configuration/vault.keystore
# Enforce firewall on DC management port (default 9990)
firewall-cmd --permanent --add-rich-rule=\
  'rule family="ipv4" source address="10.0.0.0/24" port port=9990 protocol=tcp accept'
firewall-cmd --reload