CVE-2026-12977

Summary

A sensitivity classification flaw in WildFly Core's deployment-operation handlers (e.g., upload-deployment-url) allows users with the 'Maintainer' role to read sensitive configuration files, leading to credential exposure and full administrative compromise.

Exploitability

Exploitation requires authenticated access with the 'Maintainer' role and knowledge of the vulnerable handler endpoints; no public exploit exists.

Blast radius

Successful exploitation enables full server compromise, including credential theft and elevation to SuperUser privileges, affecting all services managed by the WildFly instance.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WildFly Core 3.0.14.Final, 4.0.2.Final, or later, as these versions include the fix for improper sensitivity classification in deployment-operation handlers.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.