{"api_version":"1","generated_at":"2026-10-29T09:22:17+00:00","cve":"CVE-2026-114488","urls":{"html":"https://cve.report/CVE-2026-114488","api":"https://cve.report/api/cve/CVE-2026-114488.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-114488","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114488"},"summary":{"title":"Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding","description":"A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-10-29 06:17:19","updated_at":"2026-10-29 06:17:19"},"problem_types":["CWE-829","CWE-829 Inclusion of Functionality from Untrusted Control Sphere"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Primary","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-114488","name":"https://access.redhat.com/security/cve/CVE-2026-114488","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491619","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2491619","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114488","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114488","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat Fuse 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","version":"","platforms":[]},{"source":"CNA","vendor":"Red Hat","product":"Red Hat Single Sign-On 7","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-06-23T02:49:58.722Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-10-27T00:00:00.000Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"To mitigate this vulnerability without modifying binaries, apply one or more of the following operational and configuration controls:\n\n1. Maintain or revert caller propagation to the default 'none' setting in the IIOP subsystem configuration:\nRun the following management CLI command:\n`/subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)`\nEnsure that application deployment descriptors (such as jboss-ejb3.xml) do not explicitly override caller propagation to 'supported'.\n\n2. Restrict network reachability:\nBlock external access to the CORBA/IIOP port (default TCP port 3528) using firewall rules, or restrict access strictly to trusted application networks:\n`firewall-cmd --remove-port=3528/tcp --permanent && firewall-cmd --reload`\n\n3. Enforce transport-level security:\nIf caller propagation is required for your architecture, configure the IIOP subsystem to require SSL/TLS with client certificate authentication by setting `server-requires-ssl=\"true\"`, or enforce mandatory authentication via the `as-context` configuration.\n\nCaveats:\nDisabling caller propagation prevents client security identity forwarding across remote IIOP EJB calls, which may impact applications relying on distributed identity propagation. Restricting firewall access will prevent external clients outside authorized networks from connecting to IIOP services.\n\nWarning:\nApplying configuration changes via the JBoss management CLI requires reloading the runtime service (`:reload`), which will temporarily interrupt active client connections.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"unknown","packageName":"wildfly-iiop-openjdk","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unknown","packageName":"wildfly-ee-dist","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"defaultStatus":"unknown","packageName":"wildfly-iiop-openjdk","product":"Red Hat JBoss Enterprise Application Platform 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"defaultStatus":"affected","packageName":"wildfly-iiop-openjdk","product":"Red Hat JBoss Enterprise Application Platform 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"wildfly-iiop-openjdk","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"defaultStatus":"unknown","packageName":"wildfly-iiop-openjdk","product":"Red Hat Single Sign-On 7","vendor":"Red Hat"}],"datePublic":"2026-10-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-829","description":"Inclusion of Functionality from Untrusted Control Sphere","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-29T06:07:33.732Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-114488"},{"name":"RHBZ#2491619","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491619"}],"timeline":[{"lang":"en","time":"2026-06-23T02:49:58.722Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-27T00:00:00.000Z","value":"Made public."}],"title":"Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding","workarounds":[{"lang":"en","value":"To mitigate this vulnerability without modifying binaries, apply one or more of the following operational and configuration controls:\n\n1. Maintain or revert caller propagation to the default 'none' setting in the IIOP subsystem configuration:\nRun the following management CLI command:\n`/subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)`\nEnsure that application deployment descriptors (such as jboss-ejb3.xml) do not explicitly override caller propagation to 'supported'.\n\n2. Restrict network reachability:\nBlock external access to the CORBA/IIOP port (default TCP port 3528) using firewall rules, or restrict access strictly to trusted application networks:\n`firewall-cmd --remove-port=3528/tcp --permanent && firewall-cmd --reload`\n\n3. Enforce transport-level security:\nIf caller propagation is required for your architecture, configure the IIOP subsystem to require SSL/TLS with client certificate authentication by setting `server-requires-ssl=\"true\"`, or enforce mandatory authentication via the `as-context` configuration.\n\nCaveats:\nDisabling caller propagation prevents client security identity forwarding across remote IIOP EJB calls, which may impact applications relying on distributed identity propagation. Restricting firewall access will prevent external clients outside authorized networks from connecting to IIOP services.\n\nWarning:\nApplying configuration changes via the JBoss management CLI requires reloading the runtime service (`:reload`), which will temporarily interrupt active client connections."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-114488","datePublished":"2026-10-29T06:07:33.732Z","dateReserved":"2026-10-21T15:33:52.420Z","dateUpdated":"2026-10-29T06:07:33.732Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-29 06:17:19","lastModifiedDate":"2026-10-29 06:17:19","problem_types":["CWE-829","CWE-829 Inclusion of Functionality from Untrusted Control Sphere"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"114488","Ordinal":"1","Title":"Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication byp","CVE":"CVE-2026-114488","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"114488","Ordinal":"1","NoteData":"A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.","Type":"Description","Title":"Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication byp"}]}}}