CVE-2026-17614 Red Hat CVE debrief

Who should care

Administrators and users of WildFly's domain mode implementation, particularly those with sensitive information stored in configuration files, keystores, and system credentials, should be aware of this vulnerability. Security teams and vulnerability management teams should review and prioritize patching or mitigation efforts. Operators of affected systems should monitor for suspicious activity and review compensating controls. Platform administrators should verify configurations and implement additional security measures as needed.

Technical summary

A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences via the slave-DC wire protocol, causing the Domain Controller to resolve and serve arbitrary files readable by the DC process. This leads to unauthorized disclosure of sensitive information such as configuration files, keystores, and system credentials. The flaw has a CVSS score of 4.4 and a severity rating of MEDIUM.

Defensive priority

Medium-priority vulnerability with potential for unauthorized disclosure of sensitive information.

Recommended defensive actions

• Review and apply vendor patches or updates
• Restrict access to sensitive files and directories
• Monitor for suspicious activity and implement compensating controls
• Review configurations for potential exposure
• Implement additional logging and monitoring for affected systems
• Conduct a thorough review of system credentials and keystores
• Verify the integrity of configuration files and system credentials

Evidence notes

Evidence from official CVE and NVD sources indicates a path traversal flaw in WildFly's domain mode implementation. Limited detail available on affected scope and vendor remediation. Defenders should verify configurations, monitor for suspicious activity, and review compensating controls. The CVE record was published on 2026-08-04T03:16:25.537Z and has not been modified since then. The NVD entry is currently Awaiting Analysis. Further review of vendor advisories and security bulletins is recommended.

Official resources