CVE-2026-19610 Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-19610?
CVE-2026-19610 is a medium-severity vulnerability in Red Hat JBoss Enterprise Application Platform 7, published on 29 Oct 2026.
Official description
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.
Weakness: CWE-862
Which versions are affected by CVE-2026-19610?
How do I fix CVE-2026-19610?
No fix has been published for CVE-2026-19610 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-19610 being exploited?
There is no known exploitation of CVE-2026-19610 in the wild and no public exploit code.
Sources
Also known as GHSA-w5fp-cxgp-hgxf.