fr Sign in

4.2 Medium

CVE-2026-85511 A flaw was found in EAP's Elytron

Description

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding.

Affected products and versions

Product	Affected versions	Fixed in
Red Hat JBoss Enterprise Application Platform 7	Versions not published
Red Hat JBoss Enterprise Application Platform 8	Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack	Versions not published
Red Hat Data Grid 8	Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10	Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8	Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9	Versions not published
Red Hat Fuse 7	Versions not published
Red Hat Single Sign-On 7	Versions not published

Show the other branch

Product	Affected versions	Fixed in
Red Hat JBoss Enterprise Application Platform 8.1.8.GA 2.6	earliest → < 2.6.11.Final-redhat-00001	2.6.11.Final-redhat-00001

References

RHSA-2026:70228 access.redhat.com
RHSA-2026:70229 access.redhat.com
RHSA-2026:70230 access.redhat.com
RHSA-2026:70277 access.redhat.com
access.redhat.com access.redhat.com
RHBZ#2483140 bugzilla.redhat.com

Timeline

Published September 18, 2026
Last modified October 20, 2026

The 168 CVEs of Red Hat JBoss Enterprise Application Platform 7 →

CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High CVE-2026-93998 Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer 7.4 High CVE-2026-91920 Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium CVE-2026-114488 A flaw was found in Wildfly 7.4 High

Track this CVE