CVE-2026-84823: WildFly Path Traversal Vulnerability

CVE-2026-84823 Overview

CVE-2026-84823 is a path traversal vulnerability [CWE-22] in WildFly that allows a low-privileged user with the Monitor Role-Based Access Control (RBAC) role to write server configuration snapshots to arbitrary filesystem locations. The flaw resides in the take-snapshot management operation, where the name parameter is not properly sanitized. By supplying crafted path traversal sequences, an attacker can relocate the snapshot output to a directory they can read. This bypasses RBAC restrictions and exposes sensitive configuration data, including credentials, to accounts that should only have read-only monitoring access.

Critical Impact
Authenticated users holding the lowest standard RBAC role can disclose server configuration contents and embedded credentials, leading to further privilege escalation.

Affected Products

Red Hat JBoss Enterprise Application Platform (WildFly upstream)
WildFly application server deployments exposing the management interface
Environments relying on RBAC Monitor role segregation for sensitive configuration

Discovery Timeline

2026-10-16 - CVE-2026-84823 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-84823

Vulnerability Analysis

The vulnerability affects the take-snapshot management operation in WildFly. This operation creates a copy of the running server configuration and writes it to disk. The operation accepts a name parameter that is intended to define the snapshot filename within the configured snapshot directory.

WildFly does not validate the name value for path traversal sequences such as ../. An authenticated user holding the Monitor role, which is the lowest-privilege standard RBAC role, can invoke take-snapshot and supply a crafted name value. The resulting snapshot is written outside the designated snapshot directory to a location of the attacker's choosing.

Because the snapshot contains the full server configuration, including sensitive attributes such as credentials, data source passwords, and keystore references that are normally restricted from the Monitor role, this write-primitive translates directly into an information disclosure primitive once the file is placed in a readable location.

Root Cause

The root cause is insufficient input validation on the name parameter of the take-snapshot operation. The management layer trusts the parameter and concatenates it into a filesystem path without canonicalization or boundary enforcement against the intended snapshot directory, matching the classical Path Traversal pattern described in CWE-22.

Attack Vector

Exploitation requires network access to the WildFly management interface and valid credentials for any account mapped to the Monitor RBAC role. The attacker issues a take-snapshot management operation over the HTTP management API or CLI, embedding ../ sequences within the name parameter to redirect the output file to a world-readable or user-readable directory. Once written, the attacker retrieves the snapshot and parses the configuration XML to extract credentials and other restricted data. No user interaction is required.

The vulnerability mechanism is documented in the Red Hat CVE-2026-84823 Advisory and the Red Hat Bug Report #2527902.

Detection Methods for CVE-2026-84823

Indicators of Compromise

Management audit log entries recording take-snapshot operations initiated by accounts holding only the Monitor RBAC role.
name parameter values in take-snapshot operations containing ../, ..\, URL-encoded traversal sequences, or absolute filesystem paths.
Configuration snapshot files (.xml) appearing outside the configured data/snapshot directory on the WildFly host.

Detection Strategies

Enable the WildFly management audit log and alert on any invocation of take-snapshot by non-administrative roles.
Correlate successful Monitor role authentications with subsequent file writes to unexpected directories on the application server host.
Baseline normal snapshot filenames and alert on any name parameter that deviates from the expected pattern or contains path separators.

Monitoring Recommendations

Forward WildFly management audit logs and host filesystem telemetry to a centralized analytics platform for cross-source correlation.
Monitor for subsequent read access or exfiltration of configuration XML files that follow a take-snapshot event.
Track RBAC role assignments and alert on expansion of accounts mapped to the Monitor role, since any such account becomes an exploitation prerequisite.

How to Mitigate CVE-2026-84823

Immediate Actions Required

Apply the vendor-supplied patch referenced in the Red Hat CVE-2026-84823 Advisory as soon as it is available for your distribution.
Audit all accounts assigned the Monitor RBAC role and revoke access for any account that does not require it.
Rotate credentials, keystore passwords, and secrets stored in WildFly configuration if take-snapshot invocations by Monitor accounts are observed in audit logs.
Restrict network reachability of the WildFly management interface to trusted administrative networks only.

Patch Information

Red Hat tracks the fix under the advisory published at Red Hat CVE-2026-84823 Advisory and the associated Red Hat Bug Report #2527902. Administrators should consult these references for fixed component versions applicable to their WildFly or JBoss EAP distribution and apply updates through their standard patch management process.

Workarounds

Remove the Monitor role from accounts that do not strictly need it until patched builds are deployed.
Place the WildFly management interface behind a reverse proxy or network ACL that blocks take-snapshot operations from non-administrative source networks.
Enable and actively review the WildFly management audit log to detect exploitation attempts against the take-snapshot operation.

bash

# Configuration example: audit log activation via jboss-cli
/core-service=management/access=audit/logger=audit-log:write-attribute(name=enabled,value=true)
/core-service=management/access=audit/logger=audit-log:write-attribute(name=log-read-only,value=true)