CVE-2026-114488
Description
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires non-default configuration settings. In standard Red Hat JBoss Enterprise Application Platform configurations, caller propagation over the IIOP subsystem is set to 'none' by default, preventing unauthenticated principal assertion. Deployments become susceptible only if an administrator or application deployment explicitly enables caller propagation without enforcing client mutual TLS or mandatory authentication context. When those specific conditions are met, an unauthorized remote client communicating over the IIOP port could invoke remote enterprise beans under an assumed identity.
Mitigation
To mitigate this vulnerability without modifying binaries, apply one or more of the following operational and configuration controls:
1. Maintain or revert caller propagation to the default 'none' setting in the IIOP subsystem configuration:
Run the following management CLI command:
`/subsystem=iiop-openjdk:write-attribute(name=caller-propagation,value=none)`
Ensure that application deployment descriptors (such as jboss-ejb3.xml) do not explicitly override caller propagation to 'supported'.
2. Restrict network reachability:
Block external access to the CORBA/IIOP port (default TCP port 3528) using firewall rules, or restrict access strictly to trusted application networks:
`firewall-cmd --remove-port=3528/tcp --permanent && firewall-cmd --reload`
3. Enforce transport-level security:
If caller propagation is required for your architecture, configure the IIOP subsystem to require SSL/TLS with client certificate authentication by setting `server-requires-ssl="true"`, or enforce mandatory authentication via the `as-context` configuration.
Caveats:
Disabling caller propagation prevents client security identity forwarding across remote IIOP EJB calls, which may impact applications relying on distributed identity propagation. Restricting firewall access will prevent external clients outside authorized networks from connecting to IIOP services.
Warning:
Applying configuration changes via the JBoss management CLI requires reloading the runtime service (`:reload`), which will temporarily interrupt active client connections.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | 7.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, open redirect to malware (CWE-601), etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
