CVE-2026-84823: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Red Hat Red Hat Enterprise Linux 8
Description
CVE-2026-84823 is a path traversal vulnerability in WildFly on Red Hat Enterprise Linux 8. A user with the Monitor role, which is the lowest RBAC role, can exploit this flaw via the take-snapshot operation by manipulating the name parameter. This allows writing a copy of the server configuration to an arbitrary location and reading back sensitive credentials that should be restricted, resulting in information disclosure.
CVSS v3.1
Score 7.1high
Affected software
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Fuse 7
Red Hat
Red Hat Fuse 7
Red Hat
Red Hat JBoss Enterprise Application Platform 7
Red Hat
Red Hat JBoss Enterprise Application Platform 8
Red Hat
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat
Red Hat Single Sign-On 7
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability allows a user with the Monitor role in WildFly to exploit a path traversal issue in the take-snapshot operation. By controlling the name parameter, the attacker can write the server configuration to an arbitrary filesystem location and subsequently read sensitive configuration data, including credentials, bypassing RBAC restrictions. The flaw leads to unauthorized information disclosure.
Potential Impact
The vulnerability enables information disclosure of sensitive server configuration and credentials to users with only the Monitor role, which normally has limited access. This could facilitate further attacks or unauthorized access to sensitive data.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-84823 for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-02T10:32:15.835Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-84823","vendor":"Red Hat"}]
Threat ID: 6ad169f42cdf04f65668d354
Added to database: 10/16/2026, 00:04:04 UTC
Last enriched: 10/16/2026, 00:18:15 UTC
Last updated: 10/16/2026, 00:18:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.