CVE-2026-114488: Red Hat Fuse 7, верига на доставки

Описание

Оригинално описание

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.

Засегнати продукти

• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 8
• Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
• Red Hat Red Hat Single Sign-On 7

Вид слабост

• CWE-829 Inclusion of Functionality from Untrusted Control Sphere

История

Други уязвимости в Red Hat Red Hat Fuse 7

• 5.3CVE-2026-120971
• 4.3CVE-2026-119542
• 6.5CVE-2026-91920
• 5.4CVE-2026-118959
• 4.3CVE-2026-118947

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-114488
• https://nvd.nist.gov/vuln/detail/CVE-2026-114488
• https://access.redhat.com/security/cve/CVE-2026-114488
• https://bugzilla.redhat.com/show_bug.cgi?id=2491619